CVE-2026-50158: yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-con

Executive brief

yutu is a tool used for managing video captions. A security flaw in its caption download feature allows an attacker to write files to any location on the system that the application can access. This could be used to overwrite critical system files, potentially leading to a complete system takeover or service disruption.

Technical details

The `caption-download` MCP tool in yutu is vulnerable to arbitrary file write (CWE-73) because the user-supplied `file` parameter is passed directly to `os.Create()` in `pkg/caption/caption.go` without path validation or canonicalization. While other components use `pkg.Root` to confine I/O to the `YUTU_ROOT` directory, this specific function bypasses that boundary. An attacker can exploit this via the HTTP MCP server (which defaults to no authentication) to overwrite binaries, configuration files, or scripts. This can lead to persistent remote code execution or denial of service. The vulnerability is patched in version 0.10.9-dev1.

Affected products

• eat-pray-ai yutu < 0.10.9-dev1

Timeline

• 2026-06-06: disclosed
• 2026-07-14: advisory
• 2026-07-14: patched

References

• https://api.github.com/users/EQSTLab
• https://github.com/EQSTLab
• https://api.github.com/users/EQSTLab/gists%7B/gist_id%7D
• https://api.github.com/users/EQSTLab/repos
• https://avatars.githubusercontent.com/u/148991397?v=4
• https://api.github.com/users/EQSTLab/events%7B/privacy%7D