Auth bypass in Pulseaiclub Phi
CVE-2026-108595
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.
Vulnerability class: Broken Access Control
Published .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- hackmd.io/@haind/phi-subagent-workdir-workspace-escape (third-party-advisory)
- github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/intern… (technical-description)
- github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/intern… (technical-description)
- github.com/pulseaiclub/phi (product)
- www.vulncheck.com/advisories/phi-0.3.0-through-0.28.4-permission-bypass-via-age… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-108595?
- CVE-2026-108595 is a medium-severity vulnerability in Pulseaiclub Phi, classified under Incorrect Authorization. CVSS score: 5.3/10. Published 2026-10-10.
- How severe is CVE-2026-108595?
- Medium severity. CVSS v3 base score is 5.3 out of 10.