CVE-2026-108595

Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir

6.0 Medium

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.32%Up 0.1 points since Oct 11, 2026

What each source reports

CVE List Score used 6.0

Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir

Record: CVE-2026-108595
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2026-96399 6.0

Record: EUVD-2026-96399
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-x8rp-9mrq-5584 6.0

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub...

Record: GHSA-x8rp-9mrq-5584
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness: CWE-863
Updated: 2026-11-02

NVD 6.0

Record: CVE-2026-108595
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSV 6.0

Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir

Record: CVE-2026-108595
CVSS 4.0: 6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-863
Updated: 2026-11-02

Affected products

pulseaiclub phi

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-108595 is a medium vulnerability (CVSS 6.0) in Pulseaiclub Phi, published October 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. No source names a fixed version.