—
GO-2026-5980
yutu: Arbitrary File Write via MCP `caption-download` Tool in github.com/eat-pray-ai/yutu
Quick fix
GO-2026-5980 — github.com/eat-pray-ai/yutu: upgrade to the fixed version with the command below.
go get github.com/eat-pray-ai/yutu@v0.10.9-dev1Details
yutu: Arbitrary File Write via MCP `caption-download` Tool in github.com/eat-pray-ai/yutu
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/eat-pray-ai/yutu
Introduced in:
0Fixed in: 0.10.9-dev1Fix
go get github.com/eat-pray-ai/yutu@v0.10.9-dev1