External Control of File Name or Path Affecting github.com/eat-pray-ai/yutu/pkg/caption package, versions <0.10.9-dev1
Threat Intelligence
This vulnerability is trending on Twitter; this may indicate a growing threat.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMEATPRAYAIYUTUPKGCAPTION-17972542
- published14 Jul 2026
- disclosed14 Jul 2026
- creditUnknown
Introduced: 14 Jul 2026
NewCVE-2026-50158 (opens in a new tab)How to fix?
Upgrade github.com/eat-pray-ai/yutu/pkg/caption to version 0.10.9-dev1 or higher.
Overview
Affected versions of this package are vulnerable to External Control of File Name or Path through the caption-download process. An attacker can overwrite or create arbitrary files on the system by supplying a crafted file parameter to the MCP server, allowing modification of files outside the intended directory boundary. This can lead to persistent code execution, denial of service, or unauthorized modification of system files. This is only exploitable if the MCP server is running in HTTP mode with authentication disabled, which is the default configuration.