What is GHSA-68mc-h6h8-79wj?

GHSA-68mc-h6h8-79wj is a security advisory published by GitHub Security Advisories with Critical severity. YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution

Which CVE IDs does GHSA-68mc-h6h8-79wj cover?

GHSA-68mc-h6h8-79wj covers the following CVE IDs: CVE-2026-50880. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-68mc-h6h8-79wj?

GHSA-68mc-h6h8-79wj has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-68mc-h6h8-79wj?

GHSA-68mc-h6h8-79wj affects 1 product, including: npm/youtransfer:\u003c= 1.0.6.

GHSA-68mc-h6h8-79wjCriticalCVSS 9.8

YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution

Vendor

GitHub Security Advisories

Published

June 15, 2026

Last Modified

August 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-50880 →

📋 Description

An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.

🎯 Affected products1

npm/youtransfer:<= 1.0.6

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-50880
https://gist.github.com/pyuysig/4013f4f10f74b3fded7ddf41b6d36ae5
https://github.com/advisories/GHSA-68mc-h6h8-79wj