The vulnerability in yutu (CVE-2026-50158) involves external control of a file name or path (CWE-73) in the caption-download MCP tool. Prior to version 0.10.9, the tool accepts a file parameter from the caller and passes it to Caption.Download(), which uses os.Create() to create or truncate the file at the specified path. This operation does not enforce confinement within the YUTU_ROOT directory, allowing an attacker with the ability to invoke caption-download to write files anywhere writable by the yutu process. This can overwrite application files, configuration, shell startup files, logs, or data, potentially causing persistent code execution or denial of service. Exploitation requires local HTTP client access to the MCP server (which by default has no authentication) and valid service credentials for live caption retrieval. The vulnerability is addressed in yutu version 0.10.9.

An attacker able to invoke the caption-download tool can write arbitrary files outside the intended confinement directory, potentially overwriting critical application or system files. This can lead to persistent code execution or denial of service conditions. The vulnerability requires local access to the MCP server and valid service credentials, limiting remote exploitation. No known exploits are reported in the wild.

This vulnerability is fixed in yutu version 0.10.9. Users should upgrade to version 0.10.9 or later to remediate the issue. Additionally, enabling authentication on the MCP server can reduce the risk by preventing unauthorized invocation of the caption-download tool.