{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.0.6"}],"component":"youtransfer","cve_ids":["CVE-2026-50880"],"ecosystem":"npm","epss":0.00476,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-68mc-h6h8-79wj","id":"tcs_01M5KF6BCGGWT57QDHG9HPHQ5J","modified_at":"2026-08-26T15:26:24.784438Z","published_at":"2026-06-15T21:30:41Z","references":["https://osv.dev/vulnerability/GHSA-68mc-h6h8-79wj","https://nvd.nist.gov/vuln/detail/CVE-2026-50880","https://gist.github.com/pyuysig/4013f4f10f74b3fded7ddf41b6d36ae5","https://github.com/YouTransfer/YouTransfer"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-68mc-h6h8-79wj","url":"https://osv.dev/vulnerability/GHSA-68mc-h6h8-79wj"}],"summary":"YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution"}