I get a notification like that probably twice a day and 99 times out of 100 it's a vuln that only exists if you pass unsanitized input to the library.