The vulnerability is also present in the v2.0.x branch.

The development 2.1.x branch (which is what was on Github) had the vulnerability, and that's where I reported it, but it's not only in the new code.

I think maybe you're confused somewhere?