{"action":"Upgrade phantom-audio to 1.3.1 or later.","affected":[{"fixed":"1.3.1","introduced":"0"}],"component":"phantom-audio","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.3.1"],"ghsa_id":"GHSA-52vm-mxx8-f227","id":"tcs_01M5KEZKD14N4RATJ9WZ3YHFPS","modified_at":"2026-07-09T13:45:22.421558067Z","published_at":"2026-07-09T13:37:34Z","references":["https://osv.dev/vulnerability/GHSA-52vm-mxx8-f227","https://github.com/fadelabs/phantom/security/advisories/GHSA-52vm-mxx8-f227","https://github.com/fadelabs/phantom"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-52vm-mxx8-f227","url":"https://osv.dev/vulnerability/GHSA-52vm-mxx8-f227"}],"summary":"Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths"}