CVE-2026-108595 pulseaiclub CVE debrief

Who should care

Defenders responsible for Phi deployments should assess exposure and prioritize verification of affected versions in their environment. This includes reviewing and restricting the workdir parameter in agent_spawn and implementing additional monitoring for suspicious file writes. Defenders should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-108595 is a permission bypass vulnerability in Phi versions 0.3.0 through 0.28.4 that allows spawned sub-agents to escape workspace restrictions, potentially leading to unapproved file writes. Defenders should prioritize verifying affected versions and assessing potential impact.

• Potential for unapproved file writes
• Bypass of workspace restrictions
• Need for verification of affected versions
• Potential for exploitation requires further investigation

Technical summary

The vulnerability allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. This could lead to unapproved file writes anywhere the user can write. The vulnerability affects Phi versions 0.3.0 through 0.28.4. Defenders should prioritize verifying affected versions and assessing potential impact. The vulnerability can be triggered by supplying an unchecked workdir to agent_spawn, which could lead to unapproved file writes anywhere the user can write.

Defensive priority

Defenders should prioritize verifying the affected versions of Phi in their environment and assessing the potential impact of this vulnerability.

Recommended defensive actions

• Verify the version of Phi in use and assess exposure
• Review and restrict the workdir parameter in agent_spawn
• Implement additional monitoring for suspicious file writes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references provide information about the vulnerability, but details about exploitation, victims, or business impact are not available. The vulnerability allows spawned sub-agents to escape workspace restrictions by supplying an unchecked workdir to agent_spawn. This could lead to unapproved file writes anywhere the user can write. Defenders should verify affected versions and assess potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.