@fionafokus given the vuln remains in 0.12.4, couldn't a malicious actor simply setup an instance and go to town?

To me it feels as though that specific version should be blacklisted from federation then?