Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: pulseaiclub Clear all filters
TI-2026-70583 CVE-2026-108599 · GHSA-mhj6-8rvv-3grj

Symlink path check bypass in phi lets writes escape the workspace

Priority LOW 25

phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate.

CVSS 4.0MEDIUM 5.7 Local No auth User interaction EPSS 0.00172 Published 2026-10-10 No fix listed CWE-59
TI-2026-70579 CVE-2026-108595 · GHSA-x8rp-9mrq-5584

Permission bypass in Phi lets spawned sub-agents write outside workspace

Priority MEDIUM 60

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00315 Published 2026-10-10 No fix listed CWE-863