CVE-2026-108599

MediumCVSS 4.7

Published: 10/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

phi versions 0.1.1 through 0.28.4 contain an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.

Risk Assessment

An attacker could write files outside the workspace without authorization, potentially modifying critical system files. However, this requires prior commitment of a malicious repository and prompt injection.

Recommendation

Update phi to a version later than 0.28.4 that fixes the vulnerability. Additionally, consider enhancing path checks in the permission gate to account for symlink resolution.

Other vulnerabilities in phi

CVE-2026-108595Medium
Phi versions 0.3.0 through 0.28.4 contain a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.

Original NVD description (English source)

phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS