CVE-2026-108599

The phi software (versions 0.1.1 through 0.28.4 ) is vulnerable to an improper link resolution vulnerability (CWE-59) within its permission gate. The root cause is the use of lexical-only path checks , which allows malicious repositories to bypass workspace_only_writes restrictions. By committing...

CVE-2026-108599 Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass

phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspaceonlywrites by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make...

EUVD-2026-96393

phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspaceonlywrites by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make...

EUVD-2026-96399

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspaceonlywrites and readonly mode by supplying an unchecked workdir to agentspawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker...

CVE-2026-108595

The Phi framework (versions 0.3.0 through 0.28.4 ) contains a permission bypass vulnerability involving the agent_spawn function. The root cause is the handling of an unchecked workdir , which allows spawned sub-agents to escape workspace_only_writes and readonly modes. An attacker can leverage p...