Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Symlink bugs bypass agent write sandboxes. CVE-2026-108599, 108600 1. Path checks miss where the link points 2. Prompt injection writes outside the workspace 3. Hits phi and open-multi-agent I'd keep untrusted repos off those tools. Source: NVD https://t.co/5KW3uwPeZ3