CVE-2026-108595

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspaceonlywrites and readonly mode by supplying an unchecked workdir to agentspawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker...

CVE-2026-108595 Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspaceonlywrites and readonly mode by supplying an unchecked workdir to agentspawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker...

CVE-2026-108595

The Phi framework (versions 0.3.0 through 0.28.4 ) contains a permission bypass vulnerability involving the agent_spawn function. The root cause is the handling of an unchecked workdir , which allows spawned sub-agents to escape workspace_only_writes and readonly modes. An attacker can leverage p...

CVE-2026-108595 Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspaceonlywrites and readonly mode by supplying an unchecked workdir to agentspawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker...

CVE-2026-108595

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspaceonlywrites and readonly mode by supplying an unchecked workdir to agentspawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker...

CVE-2026-108595 Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspaceonlywrites and readonly mode by supplying an unchecked workdir to agentspawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker...

EUVD-2026-96399

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspaceonlywrites and readonly mode by supplying an unchecked workdir to agentspawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker...

CVE-2026-108595: Incorrect Authorization

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspaceonlywrites and readonly mode by supplying an unchecked workdir to agentspawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker...

Pulseaiclub phi authorization issue vulnerability

The PulseAI Club version 0.3.0 to 0.28.4 has an authorization issue vulnerability. This vulnerability stems from the fact that the agentspawn does not validate the workdir parameter. As a result, the generated sub-agent can bypass the workspaceonlywrites and readonly mode restrictions. Attackers...

CVE-2026-46701

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret "process.env'NETWORKAIMCPSECRET' ?? ''" at "bin/mcp-server.ts:89", which causes "isAuthorized" "lib/mcp-transport-sse.ts:254" to return "true" unconditionally for...