GHSA-52vm-mxx8-f227: Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths

Summary

In Phantom 1.3.0 and earlier, the MCP tools accepted arbitrary absolute output paths when PHANTOM_OUTPUT_DIR was unset, the default. Any caller able to send tool calls, such as an AI agent, could write or overwrite files the process user can write, including shell startup files. Separately, the stem-separation and render paths decoded input audio without a size or duration cap, so a small compressed FLAC or OGG file could expand to multi-gigabyte PCM and exhaust memory.

Mitigation

Fixed in 1.3.1: file writes are confined to PHANTOM_OUTPUT_DIR (default ~/.phantom/output), with symlinks resolved and re-verified on the final path; decode, duration and size guards were added to the separation and render paths, plus ffmpeg -max_alloc/-t/-fs; output creation uses atomic O_CREAT|O_EXCL. Workaround: set PHANTOM_OUTPUT_DIR (and optionally PHANTOM_AUDIO_DIR) to dedicated directories before starting the server.

Topics

• Model Context Protocol

Related items

• LowFBI arrests Saudi OpenAI employee who allegedly planted recording device in conference roomSimilar attack · CNBC Technology
• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• LowAnthropic warns self-replicating AI could spread to your smart devicesSimilar attack · BleepingComputer
• HighCVE-2026-110207: Wukong AICRM missing authorization in user and role administration APIsSimilar attack · NVD/CVE Database
• HighCVE-2026-110202: Roo Code command approval bypass via bare >& redirect prefixSimilar attack · NVD/CVE Database