CVE-2026-44641
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Microsoft APM prior to version 0.8.12 has a vulnerability that allows malicious plugins to copy arbitrary files or directories from the installer's machine. The manifest fields agents, skills, commands, and hooks are attacker-controlled, enabling the use of absolute paths or ../ for exploitation.
Risk Assessment
Organizations may be exposed to data leakage or other unauthorized file operations, potentially leading to serious security implications.
Recommendation
It is recommended to upgrade Microsoft APM to version 0.8.12 or later to mitigate this vulnerability and to monitor plugin usage for potential threats.
Other vulnerabilities in Microsoft APM
See all- CVE-2026-46383Medium
Microsoft APM prior to 0.13.0 contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on Python 3.10 and 3.11. When a local .tar.gz is not recognized as a plugin-format bundle, APM extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... The vulnerability is fixed in 0.13.0.
- CVE-2026-45539High
In versions from 0.5.4 to 0.12.4, the Microsoft APM dependency manager has a vulnerability that allows enumeration of package files and reading their content through unsafe calls to Path.glob() and Path.rglob(). Symbolic links in remote APM dependencies may be improperly processed, potentially leading to the exposure of sensitive data.
Original NVD description (English source)
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS