Skip to content
OpenAdvisories

Product · pulseaiclub

phi

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-108599

    Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass

    phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the wo…

    pulseaiclub phi
  • Medium 5.3
    CVE-2026-108595

    Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir

    Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processe…

    pulseaiclub phi