CVE-2026-108599: Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass
phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspaceonlywrites by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
A user must run an affected Phi version with workspace_only_writes enabled in a malicious repository containing symlinks that point outside the workspace. The attacker also needs prompt injection to cause Phi's write tool to write attacker-influenced content through the symlink.
Who is most exposed?
Users who run Phi against untrusted or attacker-controlled repositories are exposed, particularly where the repository can include symlinks and influence prompts processed by the write tool. The impact is modification of files outside the intended workspace boundary.
How can I assess whether a repository may be attempting this bypass?
Inspect repositories used with affected Phi versions for symlinks whose targets resolve outside the workspace. Treat repositories that combine such symlinks with content intended to influence Phi prompts or write operations as potentially malicious.