CVE-2026-108599: Improper Link Resolution Before File Access ('Link Following') in pulseaiclub phi

CVE-2026-108599 affects pulseaiclub's phi product versions 0.1.1 through 0.28.4. The vulnerability arises from improper link resolution before file access, specifically a 'link following' flaw. The permission gate relies on lexical-only path checks, which can be bypassed by attackers who commit symlinks pointing outside the intended workspace. This allows attackers to circumvent the workspace_only_writes restriction and write malicious content to files outside the workspace by leveraging prompt injection to influence the write tool's behavior.

An attacker can bypass workspace write restrictions and write arbitrary content to files outside the designated workspace without approval. This could lead to unauthorized file modifications or potential code execution depending on the context of the external files written. The vulnerability requires local access with user interaction (UI:P) and has a medium severity score (CVSS 5.7).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted repositories with phi versions 0.1.1 through 0.28.4 and restrict the ability to commit symlinks that point outside the workspace. Monitor vendor communications for official patches or updates.