Microsoft APM agent dependency manager: path traversal and symlink flaws (3 CVEs)
Three vulnerabilities disclosed in Microsoft APM, an open-source dependency manager for AI agents, allow malicious marketplace plugins or remote dependencies to copy arbitrary host files via path traversal, dereference committed symlinks into project deploy directories, and write outside the extraction root on Windows via unchecked tar extraction. All are fixed in versions 0.8.12 and 0.13.0.
Disclosed 15 May 2026 · Record updated 13 September 2026
Impact
Malicious plugins or dependencies installed via apm install could exfiltrate arbitrary readable files from the installer's machine, write dereferenced symlink content into project deploy directories (which are staged by git add by default and not flagged by SecurityGate or apm audit), and on Windows with Python 3.10/3.11 write archive members to absolute paths outside the intended directory.
Our coverage
No articles linked to this incident yet.
Sources
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-44641
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-45539
- nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-46383