Oh, definitely. CVEs have a special place to be reported in GitHub.

PSA: Do NOT use the issue tracker to report a CVE. That makes everyone's life difficult. Go through the correct channel.