Please don't open a public issue. Report it privately through GitHub security advisories. You'll get an answer within a week, and a fix or a plan once the report is confirmed.

Only the latest release gets security fixes; older releases don't. Fixes ship in a new release, so upgrade to it once it's out, and check the latest release before reporting.