Microsoft APM vulnerabilities

Microsoft APM prior to 0.13.0 contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on Python 3.10 and 3.11. When a local .tar.gz is not recognized as a plugin-format bundle, APM extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... The vulnerability is fixed in 0.13.0.

In versions from 0.5.4 to 0.12.4, the Microsoft APM dependency manager has a vulnerability that allows enumeration of package files and reading their content through unsafe calls to Path.glob() and Path.rglob(). Symbolic links in remote APM dependencies may be improperly processed, potentially leading to the exposure of sensitive data.

Microsoft APM prior to version 0.8.12 has a vulnerability that allows malicious plugins to copy arbitrary files or directories from the installer's machine. The manifest fields agents, skills, commands, and hooks are attacker-controlled, enabling the use of absolute paths or ../ for exploitation.