Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

phantom-audio

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.7PyPIAmendedPublished

    Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths

    GHSA-52vm-mxx8-f227

    Affected
    • PyPI phantom-audio <= 1.3.0
    Fixed in
    1.3.1· Vendor fix available
    Issue
    Impact In Phantom <= 1.3.0, when PHANTOMOUTPUTDIR was unset (the default), the MCP tools accepted arbitrary absolute output paths with no confinement. Anything able to send tool calls (e.g. an AI agent driving the MCP interface) could write or overwrite arbitrary files the process user can write — including shell startup files (~/.zshrc) or a Reaper startup.lua, which is effectively local code execution on a developer workstation. Separately, the stem-separation and render paths decoded input audio with no size/duration cap (the analysis path was already guarded). A small, highly compressed FLAC/OGG could expand to multi-gigabyte PCM, causing memory-exhaustion DoS, and widened exposure to decoder bugs including libsndfile CVE-2026-37555. Patches Fixed in 1.3.1: - File writes are always confined to PHANTOMOUTPUTDIR (default ~/.phantom/output); symlinks resolved and re-verified on the final path. - Decode/duration/size guards mirrored onto the separation and render paths (plus ffmpeg…

    Recommended action: Upgrade to 1.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →