CVE-2026-44641

Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr
https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Microsoft APM es un gestor de dependencias de código abierto, impulsado por la comunidad, para agentes de IA. Antes de la versión 0.8.12, Microsoft APM normaliza los plugins del marketplace copiando los componentes del plugin referenciados en plugin.json en .apm/. Los campos del manifiesto agents, skills, commands y hooks están controlados por el atacante, pero la implementación no garantiza que esas rutas permanezcan dentro del directorio del plugin. Un plugin malicioso puede, por lo tanto, usar rutas absolutas o rutas de recorrido .. / para copiar archivos o directorios arbitrarios legibles del host desde la máquina del instalador durante apm install. Esta vulnerabilidad se corrige en la versión 0.8.12.

Information

Published : 2026-05-15 17:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44641

Mitre link : CVE-2026-44641

CVE.ORG link : CVE-2026-44641

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-73

External Control of File Name or Path

{"id": "CVE-2026-44641", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44641", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-15T17:48:37.067375Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "microsoft", "product": "apm", "versions": [{"status": "affected", "version": "< 0.8.12"}]}]}], "published": "2026-05-15T17:16:47.633", "references": [{"url": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12."}, {"lang": "es", "value": "Microsoft APM es un gestor de dependencias de c\u00f3digo abierto, impulsado por la comunidad, para agentes de IA. Antes de la versi\u00f3n 0.8.12, Microsoft APM normaliza los plugins del marketplace copiando los componentes del plugin referenciados en plugin.json en .apm/. Los campos del manifiesto agents, skills, commands y hooks est\u00e1n controlados por el atacante, pero la implementaci\u00f3n no garantiza que esas rutas permanezcan dentro del directorio del plugin. Un plugin malicioso puede, por lo tanto, usar rutas absolutas o rutas de recorrido .. / para copiar archivos o directorios arbitrarios legibles del host desde la m\u00e1quina del instalador durante apm install. Esta vulnerabilidad se corrige en la versi\u00f3n 0.8.12."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security-advisories@github.com"}