Libre Panel runs a local web server for the editor (127.0.0.1 only) and loads themes that other people share. Issues that let a theme run code, read or write files outside its folder, or let a website or another user of the same PC talk to the editor are security bugs. The server answers only requests that carry the secret token of the run, which only the person who started Libre Panel gets (how).

Please report them privately through GitHub's security advisories rather than a public issue. You will get an answer within a week.