Threats affecting pkg:github/eat-pray-ai/yutu

CVE-2026-50158 is a high-severity vulnerability in the eat-pray-ai yutu toolkit prior to version 0.10.9. It involves external control of a file name or path in the caption-download MCP tool, allowing an attacker with access to invoke caption-download to write files outside the intended confinement boundary. This can lead to overwriting critical files and potentially persistent code execution or denial of service. The vulnerability requires local HTTP client access when the MCP server runs without authentication and valid service credentials for live caption retrieval. The issue is fixed in version 0.10.9.