Skip to content
OpenAdvisories

Package · PyPI

phantom-audio

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.7
    GHSA-52vm-mxx8-f227

    Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths

    ### Impact In Phantom <= 1.3.0, when `PHANTOM_OUTPUT_DIR` was unset (the default), the MCP tools accepted arbitrary absolute output paths with no confinement. Anything able to send tool calls (e.g. an AI agent driving the MCP interface) could **write or overw…

    phantom-audio PyPI