| id: GO-2026-5980 | |
| modules: | |
| - module: github.com/eat-pray-ai/yutu | |
| versions: | |
| - fixed: 0.10.9-dev1 | |
| vulnerable_at: 0.10.8 | |
| summary: 'yutu: Arbitrary File Write via MCP `caption-download` Tool in github.com/eat-pray-ai/yutu' | |
| cves: | |
| - CVE-2026-50158 | |
| ghsas: | |
| - GHSA-2c7f-fxww-6w6c | |
| references: | |
| - advisory: https://github.com/eat-pray-ai/yutu/security/advisories/GHSA-2c7f-fxww-6w6c | |
| - fix: https://github.com/eat-pray-ai/yutu/commit/87026c4eee1ed28775383807087343a750707bf3 | |
| - web: https://github.com/eat-pray-ai/yutu/releases/tag/v0.10.9-dev1 | |
| source: | |
| id: GHSA-2c7f-fxww-6w6c | |
| created: 2026-07-17T13:15:30.861260392-04:00 | |
| review_status: UNREVIEWED |