Just say "supply chain attacks" and the price can reach millions.

I just asked around, I immediately had someone who I've sold exploits to tell me I could field 45k for a bug like this. There's a lot of conditions to selling exploits -- the biggest being that you don't get to blog about what you sell. But it is real money.

Your feeling is correct, although as other comments have mentioned it depends greatly on how you market it and to whom. Probably well above $5-10k though.

Bug bounty is good in some respects, but the people who profit the most from it are the companies and platforms. IMO it feels dirty to exploit people’s good intentions and ethics (reporting vs selling) for profits, but that’s corporations for you.

Fortunately, demand for such bugs is pretty low ^, so, $1~2k I guess.

^ this is both a good and a sad indicator, it means the bar of post-exploitation for such a bug (on developers' boxes) is "sufficiently high" that your favorite ransomware gangs are not eager to get on. OTOH it means they have way more "easier" enterprise-y targets...