If it is on GitHub, they recently launched a bunch of security related features, including guiding the reporting process, obtaining CVEs and a bounty program:

https://www.opensourcesecuritypodcast.com/2019/12/episode-17...

Otherwise, try to go through the CVE process so that redistributors of the project (such as Debian or RedHat) fix the issue in their copies of the project:

https://cve.mitre.org/cve/request_id.html