Phi prior to 0.28.4 contains an improper link resolution flaw that allows a malicious repository to bypass the workspace_only_writes restriction. The vulnerability stems from lexical‑only path checks in the permission gate, enabling attackers to commit symlinks that resolve to locations outside the workspace. By combining these symlinks with prompt injection in the write tool, an attacker can cause the tool to write attacker‑specified content directly to external files without permission, thereby breaching confidentiality and integrity of non‑workspace data.

Users and organizations deploying phi versions 0.1.1 through 0.28.4 are affected. The vulnerable component resides in the internal permission gate and write tool of pulseaiclub's phi repository. The affected product is the phi application, a git‑repository‑management tool maintained by pulseaiclub. The issue does not exist in versions prior to 0.1.1 or after 0.28.4, based on current disclosure.

The CVSS score of 5.7 indicates a medium severity flaw that can lead to unauthorized file writes. The EPSS score is not available, so the probability of exploitation is currently unknown, but the fact that the bug can be triggered by a malicious repository suggests a realistic attack scenario. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through malicious repository content combined with prompt injection to coerce the write tool into targeting external paths.