Since this is a RCE bug, sure, you can fix it. But its not your place to fix a vulnerability. It's on the vendor to provide the patch. I will point out like it

Since this is a RCE bug, sure, you can fix it. But its not your place to fix a vulnerability. It's on the vendor to provide the patch. I will point out like its been pointed out in another comment this probably breaks the law somewhere.