Skip to content
OpenAdvisories

Package · Go

github.com/eat-pray-ai/yutu

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.7
    CVE-2026-50158

    yutu: Arbitrary File Write via MCP `caption-download` Tool

    yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-controlled file parameter through cmd/caption/download.go and passes it to Caption.Download() in pkg/caption/caption.go, w…

    eat-pray-ai yutu github.com/eat-pray-ai/yutu Go