yutu: Arbitrary File Write via MCP `caption-download` Tool

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-50158 · Microsoft / collected KEV context

EUVD-2026-82566

GHSA-2c7f-fxww-6w6c

GO-2026-5980

cve-program · CVE-2026-50158

• https://github.com/eat-pray-ai/yutu/security/advisories/GHSA-2c7f-fxww-6w6c
• https://github.com/eat-pray-ai/yutu/commit/87026c4eee1ed28775383807087343a750707bf3
• https://github.com/eat-pray-ai/yutu/releases/tag/v0.10.9

euvd · EUVD-2026-82566

• https://github.com/eat-pray-ai/yutu/security/advisories/GHSA-2c7f-fxww-6w6c
• https://github.com/eat-pray-ai/yutu/commit/87026c4eee1ed28775383807087343a750707bf3
• https://github.com/eat-pray-ai/yutu/releases/tag/v0.10.9

nvd · CVE-2026-50158

• https://github.com/eat-pray-ai/yutu/commit/87026c4eee1ed28775383807087343a750707bf3
• https://github.com/eat-pray-ai/yutu/releases/tag/v0.10.9
• https://github.com/eat-pray-ai/yutu/security/advisories/GHSA-2c7f-fxww-6w6c

osv · GHSA-2c7f-fxww-6w6c

• https://github.com/eat-pray-ai/yutu/security/advisories/GHSA-2c7f-fxww-6w6c
• https://github.com/eat-pray-ai/yutu/commit/87026c4eee1ed28775383807087343a750707bf3
• https://github.com/eat-pray-ai/yutu
• https://github.com/eat-pray-ai/yutu/releases/tag/v0.10.9-dev1

osv · GO-2026-5980

• https://github.com/eat-pray-ai/yutu/security/advisories/GHSA-2c7f-fxww-6w6c
• https://github.com/eat-pray-ai/yutu/commit/87026c4eee1ed28775383807087343a750707bf3
• https://github.com/eat-pray-ai/yutu/releases/tag/v0.10.9-dev1

No related operational record is retained in the current change model.