Earlier, I was messaged about a potential security risk in one of my projects. I checked it and found that it allows for "arbitrary code execution". (Quotes because it is running in a VM, but the damage that can be done is huge nonetheless)
Since it is an open source project, I imagine other people have found it and exploited it already. However, I am reluctant to fix it, because everybody will be able to see the commit and know about the exploit. Since I have no way of contacting the users and no way of forcing an update (updates are manual), I am at a loss at what to do here.
If I let it stay, people are going to exploit it. If I fix it, people are going to exploit it even more.
How can I proceed?