Publish it to the wide world, preferably by sending it to a public security mailing list that also has an html viewer - but make sure to also mail the maintaine

Publish it to the wide world, preferably by sending it to a public security mailing list that also has an html viewer - but make sure to also mail the maintainer and all maintainers of forks and distros that you can find in the same email. It is important everyone who is using the software is aware of any issues right away so that they can patch it themselves if they need to. It is also important that the maintainers of forks are not disadvantaged. Remember, after all the maintainer of the "original" could be a malicious actor, or it could be possible that they were replaced by one such malicious actor.