Report a vulnerability through GitHub's private advisory form. Include the version, the smallest reproduction and what an attacker gains. You should get an acknowledgement within a few working days and a disclosure timeline before anything is published.