Do not open public issues for active vulnerabilities. Send a private report to the repository maintainers with reproduction steps, affected versions, and any available mitigation.