First of all actually it is not a vulnerability at all, as only authorized users can create a package or post, and who have authorization to create a post, can exploit site adding javascript / XSS inside post content, so, don’t worry about it at all, however next update ( which is coming within next week ) we are adding an option to sanitize file name, but it is coming as an option , not as a fix, as it is even not an issue actually.
