Open-source package vulnerability · npm

CVE-2026-50880: YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution

criticalCVSS 3.1 9.8GHSA-68mc-h6h8-79wj

An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.

Published Jun 15, 2026 · Updated Aug 26, 2026

Affected packages

youtransfer

Ecosystem: npm
Affected: <= 1.0.6
Fixed in: No patched version yet
Check: npm ls youtransfer

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-50880
https://gist.github.com/pyuysig/4013f4f10f74b3fded7ddf41b6d36ae5
https://github.com/advisories/GHSA-68mc-h6h8-79wj

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology