Executive brief
Phantom, an AI-driven audio engineering system, contains vulnerabilities that allow unauthorized file manipulation and service disruptions. An attacker or a malicious AI agent could overwrite critical system files to gain control over a developer's workstation or submit specially crafted audio files to crash the system by exhausting its memory. These issues could lead to a total compromise of the host machine or significant operational downtime.
Technical details
Phantom <= 1.3.0 suffers from multiple vulnerabilities. First, the Model Context Protocol (MCP) tools fail to confine output paths when PHANTOM_OUTPUT_DIR is unset, allowing arbitrary file writes/overwrites (CWE-22, CWE-73). This can be exploited by any entity capable of sending tool calls, such as an AI agent, to achieve local code execution by overwriting shell startup files. Second, the stem-separation and render paths lack size or duration caps during audio decoding (CWE-400). An attacker can provide highly compressed audio files (e.g., FLAC/OGG) that expand into massive PCM data, leading to memory exhaustion and potential exploitation of underlying decoder vulnerabilities like libsndfile. Version 1.3.1 fixes these by enforcing directory confinement, resolving symlinks, and implementing decoding guards.
Affected products
- fadelabs phantom-audio <= 1.3.0
Timeline
- 2026-06-01: disclosed: Initial disclosure by leesaenz
- 2026-07-09: advisory: GitHub Advisory published
- 2026-07-09: patched: Fixed in version 1.3.1