Go/github.com/eat-pray-ai/yutu CVE-2026-50158: unknown, EPSS 0.23%
yutu: Arbitrary File Write via MCP `caption-download` Tool in github.com/eat-pray-ai/yutu
Action: Upgrade github.com/eat-pray-ai/yutu to 0.10.9-dev1 or later.
go get github.com/eat-pray-ai/yutu@v0.10.9-dev1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.10.9-dev1 | - |
Fixed versions
| 0.10.9-dev1 |
Sources
- osv: GO-2026-5980
- https://github.com/eat-pray-ai/yutu/security/advisories/GHSA-2c7f-fxww-6w6c
- https://github.com/eat-pray-ai/yutu/commit/87026c4eee1ed28775383807087343a750707bf3
- https://github.com/eat-pray-ai/yutu/releases/tag/v0.10.9-dev1
CVE-2026-50158 · published · modified · JSON