Report a vulnerability through GitHub's private vulnerability reporting, not a public issue. The security policy says which versions get fixes and the risks to know.