Please report a vulnerability privately, through Report a vulnerability on the repository's Security tab (GitHub private vulnerability reporting). Don't open a public issue for it.

You'll get an answer in the advisory thread. Fixes ship as a patch release through the normal release flow, and the advisory is published once a fixed version is on nuget.org.

Only the latest release of each package is supported.