CVE-2026-108595 — Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked wo…
Published: 2026-10-10 · CVSS: 6.0 · CVSS 4.0
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7