CVE-2026-45539
HighCVSS 7.4Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
In versions from 0.5.4 to 0.12.4, the Microsoft APM dependency manager has a vulnerability that allows enumeration of package files and reading their content through unsafe calls to Path.glob() and Path.rglob(). Symbolic links in remote APM dependencies may be improperly processed, potentially leading to the exposure of sensitive data.
Risk Assessment
Organizations may be exposed to data leaks or unauthorized file modifications, which can lead to serious security and integrity issues within applications.
Recommendation
It is recommended to upgrade to version 0.13.0 or later to eliminate this vulnerability and to review and secure existing files before deployment.
Other vulnerabilities in Microsoft APM
See all- CVE-2026-46383Medium
Microsoft APM prior to 0.13.0 contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on Python 3.10 and 3.11. When a local .tar.gz is not recognized as a plugin-format bundle, APM extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... The vulnerability is fixed in 0.13.0.
- CVE-2026-44641High
Microsoft APM prior to version 0.8.12 has a vulnerability that allows malicious plugins to copy arbitrary files or directories from the installer's machine. The manifest fields agents, skills, commands, and hooks are attacker-controlled, enabling the use of absolute paths or ../ for exploitation.
Original NVD description (English source)
Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS