The DiveJSON format's security considerations — what a document can contain, what readers must guard against — are §9 of the specification.
For a vulnerability in the tools published by this organization (the validator and the converters, which read files this project did not write; the website), use GitHub's private vulnerability reporting on the affected repository ("Report a vulnerability" under its Security tab) rather than a public issue.