What happened
A path-traversal-style flaw in yutu's caption-download MCP tool lets a caller-supplied file path be used directly in a file-creation call, enabling arbitrary file creation/truncation on the host.
Why it matters
Arbitrary file write from an AI-agent-callable tool can be leveraged for data destruction or, in combination with other primitives, code execution, though the niche single-purpose tool limits overall exposure.
Attack vector
The caption-download MCP tool accepts a caller-controlled file parameter that is passed to os.Create() without path validation, allowing an attacker to create or truncate arbitrary files reachable by the process.
Affected systems
yutu < 0.10.9
Mitigation
Upgrade to yutu 0.10.9 or later.