Please don't open a public issue for a security problem.

Report it privately from the repository's Security tab with Report a vulnerability. That sends it to the maintainers only.

If a repository doesn't offer that option, open an issue that says only that you have a security report and would like a maintainer to contact you. Leave out any details until a maintainer replies.