https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 12:29:27 +0000 https://vulnerability.circl.lu/vuln/cve-2026-44641 <p><strong>Affected:</strong> microsoft apm</p> <p>Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer&#39;s machine during apm install. This vulnerability is fixed in 0.8.12.</p> <p><strong>Affected:</strong> microsoft apm</p> <p>Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer&#39;s machine during apm install. This vulnerability is fixed in 0.8.12.</p> https://vulnerability.circl.lu/vuln/cve-2026-44641 https://vulnerability.circl.lu/vuln/ghsa-xhrw-5qxx-jpwr <p><strong>Affected:</strong> PyPI: apm-cli</p> <p>### Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in `plugin.json` into `.apm/`. The manifest fields `agents`, `skills`, `commands`, and `hooks` are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or `../` traversal paths to copy arbitrary readable host files or directories from the installer&#39;s machine during `apm install`.</p> <p>In the verified primary proof of concept, a malicious plugin sets `plugin.json.commands` to an external markdown file. A single `apm install` copies that outside file into `.apm/prompts/` and then auto-integrates it into `.github/prompts/secret.prompt.md` in the victim project. This is a local supply-chain trust-boundary violation with direct confidentiality and integrity impact.</p> <p>Reviewed version and commit:</p> <p>- `apm-cli` version `0.8.11` - `main` commit `70b34faa16a5a783424698163deeb028854fd23a`</p> <p>### Details Root cause:</p> <p>- `src/apm_cli/deps/plugin_parser.py:336-348` - `_resolve_sources()` joins manifest-controlled `agents`, `skills`, `commands`, and directory-form `hooks` paths with `plugin_path` - it checks only `exists()` and `is_symlink()` - it does not resolve the candidate and verify containment inside the plugin root - `src/apm_cli/deps/plugin_parser.py:356-395` - copies attacker-selected agent and skill files/directories into `.apm/` - `src/apm_cli/deps/plugin_parser.py:397-45…</p> <p><strong>Affected:</strong> PyPI: apm-cli</p> <p>### Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in `plugin.json` into `.apm/`. The manifest fields `agents`, `skills`, `commands`, and `hooks` are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or `../` traversal paths to copy arbitrary readable host files or directories from the installer&#39;s machine during `apm install`.</p> <p>In the verified primary proof of concept, a malicious plugin sets `plugin.json.commands` to an external markdown file. A single `apm install` copies that outside file into `.apm/prompts/` and then auto-integrates it into `.github/prompts/secret.prompt.md` in the victim project. This is a local supply-chain trust-boundary violation with direct confidentiality and integrity impact.</p> <p>Reviewed version and commit:</p> <p>- `apm-cli` version `0.8.11` - `main` commit `70b34faa16a5a783424698163deeb028854fd23a`</p> <p>### Details Root cause:</p> <p>- `src/apm_cli/deps/plugin_parser.py:336-348` - `_resolve_sources()` joins manifest-controlled `agents`, `skills`, `commands`, and directory-form `hooks` paths with `plugin_path` - it checks only `exists()` and `is_symlink()` - it does not resolve the candidate and verify containment inside the plugin root - `src/apm_cli/deps/plugin_parser.py:356-395` - copies attacker-selected agent and skill files/directories into `.apm/` - `src/apm_cli/deps/plugin_parser.py:397-45…</p> https://vulnerability.circl.lu/vuln/ghsa-xhrw-5qxx-jpwr https://vulnerability.circl.lu/vuln/pysec-2026-2379 <p><strong>Affected:</strong> PyPI: apm-cli</p> <p>### Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in `plugin.json` into `.apm/`. The manifest fields `agents`, `skills`, `commands`, and `hooks` are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or `../` traversal paths to copy arbitrary readable host files or directories from the installer&#39;s machine during `apm install`.</p> <p>In the verified primary proof of concept, a malicious plugin sets `plugin.json.commands` to an external markdown file. A single `apm install` copies that outside file into `.apm/prompts/` and then auto-integrates it into `.github/prompts/secret.prompt.md` in the victim project. This is a local supply-chain trust-boundary violation with direct confidentiality and integrity impact.</p> <p>Reviewed version and commit:</p> <p>- `apm-cli` version `0.8.11` - `main` commit `70b34faa16a5a783424698163deeb028854fd23a`</p> <p>### Details Root cause:</p> <p>- `src/apm_cli/deps/plugin_parser.py:336-348` - `_resolve_sources()` joins manifest-controlled `agents`, `skills`, `commands`, and directory-form `hooks` paths with `plugin_path` - it checks only `exists()` and `is_symlink()` - it does not resolve the candidate and verify containment inside the plugin root - `src/apm_cli/deps/plugin_parser.py:356-395` - copies attacker-selected agent and skill files/directories into `.apm/` - `src/apm_cli/deps/plugin_parser.py:397-45…</p> <p><strong>Affected:</strong> PyPI: apm-cli</p> <p>### Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in `plugin.json` into `.apm/`. The manifest fields `agents`, `skills`, `commands`, and `hooks` are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or `../` traversal paths to copy arbitrary readable host files or directories from the installer&#39;s machine during `apm install`.</p> <p>In the verified primary proof of concept, a malicious plugin sets `plugin.json.commands` to an external markdown file. A single `apm install` copies that outside file into `.apm/prompts/` and then auto-integrates it into `.github/prompts/secret.prompt.md` in the victim project. This is a local supply-chain trust-boundary violation with direct confidentiality and integrity impact.</p> <p>Reviewed version and commit:</p> <p>- `apm-cli` version `0.8.11` - `main` commit `70b34faa16a5a783424698163deeb028854fd23a`</p> <p>### Details Root cause:</p> <p>- `src/apm_cli/deps/plugin_parser.py:336-348` - `_resolve_sources()` joins manifest-controlled `agents`, `skills`, `commands`, and directory-form `hooks` paths with `plugin_path` - it checks only `exists()` and `is_symlink()` - it does not resolve the candidate and verify containment inside the plugin root - `src/apm_cli/deps/plugin_parser.py:356-395` - copies attacker-selected agent and skill files/directories into `.apm/` - `src/apm_cli/deps/plugin_parser.py:397-45…</p> https://vulnerability.circl.lu/vuln/pysec-2026-2379