phi CVE-2026-108599

Exploitation requires the victim to run the phi agent against an attacker-controlled or attacker-influenced repository while the workspace_only_writes restriction is active (this is the control being bypassed). The repository must contain a symlink resolving to a path outside the workspace, and the agent must process attacker-supplied content that successfully prompt-injects the write tool into targeting that symlinked path; the permission gate then permits the write because it validates the lexical path string rather than the resolved symlink target. Limiting factors: local attack vector (not network-remote), required user interaction (the victim must operate the agent on the untrusted repo), dependency on a prompt-injection succeeding, and applicability only to vulnerable versions 0.1.1 through 0.28.4. The attacker gains no confidentiality or availability impact - only unauthorized integrity (out-of-workspace writes).

This is a medium-severity, locally-scoped sandbox-escape rather than a high-urgency remote threat. The input CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P, score 5.7) is internally consistent with the description: exploitation is local (the phi agent operates on a local workspace), requires no attacker privileges on the victim host (PR:N - the attacker only supplies a malicious repository), but carries an explicit attack requirement (AT:P) and passive user interaction (UI:P) because the victim must actually run the agent against the attacker's repo and the injected prompt must succeed. Impact is integrity-only (VI:H; VC:N/VA:N), reflecting unauthorized out-of-workspace file writes with no inherent confidentiality or availability loss and no scope change to other systems (SC/SI/SA:N). No EPSS score, no CISA KEV entry, and no explicit POC flag were provided in the input, so exploitation probability cannot be quantified from the data; however, VulnCheck published a detailed advisory plus a HackMD technical write-up referencing the exact vulnerable source lines (gate.go L106-L119, write.go L64-L68), which raises the practical likelihood that working exploit mechanics are reconstructable even though no packaged exploit is confirmed. Net: a genuine security-control bypass worth patching for anyone running phi against untrusted repositories, but not a drop-everything priority given the local vector, required user interaction, dependency on a successful prompt injection, and the product's limited deployment footprint. No conflicting signals between vector and description were found - both agree on local, user-interaction-dependent, integrity-focused exploitation.

A developer uses the phi AI coding agent (with workspace_only_writes enabled) to work on a repository supplied or influenced by an attacker. The repo contains a symlink pointing outside the workspace plus content crafted to prompt-inject the agent, so that when the write tool is invoked the permission gate's lexical-only path check passes while the resolved symlink target escapes the workspace, writing attacker-influenced content to an external file (e.g. a shell profile or config) without user approval. No packaged public exploit is identified in the input, but VulnCheck's advisory and a HackMD write-up document the exact flawed code paths.