CVE-2026-44641

High

Published: 15/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Microsoft APM prior to version 0.8.12 has a vulnerability that allows malicious plugins to copy arbitrary files or directories from the installer's machine. The manifest fields agents, skills, commands, and hooks are attacker-controlled, enabling the use of absolute paths or ../ for exploitation.

Risk Assessment

Organizations may be exposed to data leakage or other unauthorized file operations, potentially leading to serious security implications.

Recommendation

It is recommended to upgrade Microsoft APM to version 0.8.12 or later to mitigate this vulnerability and to monitor plugin usage for potential threats.

Other vulnerabilities in Microsoft APM

CVE-2026-45539High
In versions from 0.5.4 to 0.12.4, the Microsoft APM dependency manager has a vulnerability that allows enumeration of package files and reading their content through unsafe calls to Path.glob() and Path.rglob(). Symbolic links in remote APM dependencies may be improperly processed, potentially leading to the exposure of sensitive data.

Original NVD description (English source)

Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.