Most recent entries from all

CVE-2026-44641 — Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install

2026-10-04T12:29:28.312999+00:00

Affected: microsoft apm

Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.

GHSA-xhrw-5qxx-jpwr — Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install

2026-10-04T12:29:28.313106+00:00

Affected: PyPI: apm-cli

### Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in `plugin.json` into `.apm/`. The manifest fields `agents`, `skills`, `commands`, and `hooks` are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or `../` traversal paths to copy arbitrary readable host files or directories from the installer's machine during `apm install`.

In the verified primary proof of concept, a malicious plugin sets `plugin.json.commands` to an external markdown file. A single `apm install` copies that outside file into `.apm/prompts/` and then auto-integrates it into `.github/prompts/secret.prompt.md` in the victim project. This is a local supply-chain trust-boundary violation with direct confidentiality and integrity impact.

Reviewed version and commit:

- `apm-cli` version `0.8.11` - `main` commit `70b34faa16a5a783424698163deeb028854fd23a`

### Details Root cause:

- `src/apm_cli/deps/plugin_parser.py:336-348` - `_resolve_sources()` joins manifest-controlled `agents`, `skills`, `commands`, and directory-form `hooks` paths with `plugin_path` - it checks only `exists()` and `is_symlink()` - it does not resolve the candidate and verify containment inside the plugin root - `src/apm_cli/deps/plugin_parser.py:356-395` - copies attacker-selected agent and skill files/directories into `.apm/` - `src/apm_cli/deps/plugin_parser.py:397-45…

PYSEC-2026-2379 — Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install

2026-10-04T12:29:28.313225+00:00

Affected: PyPI: apm-cli

Reviewed version and commit:

- `apm-cli` version `0.8.11` - `main` commit `70b34faa16a5a783424698163deeb028854fd23a`

### Details Root cause: