> reported it as unauthenticated remote code execution that works in both directions

> but it wasn't recognized as a security issue at the time and no release shipped with the fix until now

I'm always getting my dangerous RCE bugs mixed up with my harmless RCE bugs.

I'm curious how this was reported and fixed back in Feb but nobody recognized the importance. A case of AI automation and nobody at the wheel?