Description
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
pulseaiclub phi
Default version status: unaffected
0.3.0 to ≤ 0.28.4affected
pkg:golang/github.com/pulseaiclub/phiReferences
- https://hackmd.io/@haind/phi-subagent-workdir-workspace-escape ↗
- https://github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/internal/tools/agenttool/agent.go#L106-L120 ↗
- https://github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/internal/agent/engine_runner.go#L52-L60 ↗
- https://github.com/pulseaiclub/phi ↗
- https://www.vulncheck.com/advisories/phi-0.3.0-through-0.28.4-permission-bypass-via-agent-spawn-workdir ↗