Report it privately at https://github.com/erictran308/tuimail/security/advisories/new (Security → Report a vulnerability), not in a public issue.

Say what a message, a server's answer or a file has to contain, what happens, your tuimail version (tuimail --version), OS and terminal.

Anything a message you receive, a mail server, or a file tuimail is pointed at can do to you through tuimail. For example:

• a subject, name, text or file name that runs code, opens something without asking, or garbles the terminal;
• a message that makes tuimail fetch something from the internet, or tells its sender you read it;
• a server that gets tuimail to send your password without TLS, or to send commands it didn't build;
• an attachment saved over another file, or outside the folder it's saved in;
• your password, accounts or mail left where another account on the computer can read them.