CVE-2026-108595

MEDIUM 5.3

Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.

CWE	CWE-863
Vendor	pulseaiclub
Product	phi
Published	Oct 10, 2026

Stay Ahead of the Next One

Get instant alerts for pulseaiclub phi

Be the first to know when new medium vulnerabilities affecting pulseaiclub phi are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

pulseaiclub / phi

0.3.0 ≤ 0.28.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@haind/phi-subagent-workdir-workspace-escape github.com: https://github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/internal/tools/agenttool/agent.go#L106-L120 github.com: https://github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/internal/agent/engine_runner.go#L52-L60 github.com: https://github.com/pulseaiclub/phi vulncheck.com: https://www.vulncheck.com/advisories/phi-0.3.0-through-0.28.4-permission-bypass-via-agent-spawn-workdir

Credits

HaiND from the Post and Telecommunication Institute of Technology