The vulnerability (CWE-863) allows spawned sub-agents to escape the intended workspace boundaries by providing an unchecked working directory to the agent_spawn function. This bypass of the workspace_only_writes and readonly restrictions permits the agent to write files anywhere in locations that the user process can access, effectively granting arbitrary file write capability. The flaw can be triggered when an attacker injects instructions into processed content, leading to the agent spawning a worker rooted outside the designated workspace.

The affected product is pulseaiclub’s phi application, versions ranging from 0.3.0 up to and including 0.28.4.

The CVSS score of 6.0 categorizes the issue as moderate severity. No EPSS score is available, so the likelihood of exploitation in the wild is unclear. The vulnerability is not listed in the CISA KEV catalog. Attacking requires the ability to supply custom work‑directory arguments to agent_spawn, which may be possible through local user interaction or exposed phi interfaces. If the application is reachable by remote actors, the attack vector could extend beyond local users; otherwise the threat is limited to local or privileged users who can influence the agent_spawn call.