That's the correct behaviour. It's supposed to be patched in El Capitan by default.