Security fixes land on the latest release. Earlier releases are not maintained.

Report vulnerabilities privately through GitHub's advisory form:

https://github.com/wolph/python-progressbar/security/advisories/new

That keeps the report out of the public issue tracker until a fix is available. If you cannot use the form, mail Wolph@Wol.ph instead.

Please include the progressbar2 version, the configuration that triggers the issue and a minimal reproduction. Expect an acknowledgement within a week.