CVE-2026-108595: Incorrect Authorization in pulseaiclub phi

CVE-2026-108595 describes a permission bypass vulnerability in pulseaiclub's phi software versions 0.3.0 through 0.28.4. The flaw arises because spawned sub-agents can bypass workspace_only_writes and readonly mode restrictions by providing an unchecked workdir parameter to the agent_spawn function. Attackers can exploit this by injecting malicious instructions into processed content, causing the agent to spawn a worker rooted outside the intended workspace, allowing unauthorized file writes anywhere writable by the user.

An attacker can bypass intended write restrictions and cause the software to write files outside the designated workspace, potentially leading to unauthorized modification of files in any location where the user has write permissions. This could result in data integrity issues or unauthorized changes to the file system within the user's privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when processing untrusted content that could influence agent_spawn parameters. Restricting user input that controls working directories may reduce risk.