CVE-2026-108595

MediumCVSS 5.3

Published: 10/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Phi versions 0.3.0 through 0.28.4 contain a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.

Risk Assessment

An attacker could write files outside the workspace without authorization, potentially modifying critical files. However, this requires prompt injection in processed content.

Recommendation

Update phi to a version later than 0.28.4 that fixes the vulnerability. Additionally, consider validating the workdir passed to agent_spawn and restricting write permissions of child processes.

Other vulnerabilities in phi

CVE-2026-108599Medium
phi versions 0.1.1 through 0.28.4 contain an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.

Original NVD description (English source)

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS