luckily the security problem currently isn't exploitable for other reasons