CVE-2026-46383

Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3
https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Microsoft APM es un gestor de dependencias de código abierto, impulsado por la comunidad, para agentes de IA. Antes de 0.13.0, Microsoft APM contiene una falla de límite en la extracción de archivos específica de Windows en la sonda de paquete heredado utilizada por apm install [bundle] en tiempos de ejecución de Python 3.10 y 3.11 compatibles. Cuando a apm install se le da un .tar.gz local que no es reconocido como un paquete con formato de plugin, APM sondea si es un paquete apm heredado con formato --format. En versiones de Python anteriores a la 3.12, esa sonda extrae miembros tar no confiables directamente con tar.extractall() sin rechazar nombres de miembros absolutos de Windows como D:/.... Esta vulnerabilidad está corregida en 0.13.0.

Information

Published : 2026-05-15 17:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-46383

Mitre link : CVE-2026-46383

CVE.ORG link : CVE-2026-46383

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-73

External Control of File Name or Path

{"id": "CVE-2026-46383", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46383", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T17:48:40.768904Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "microsoft", "product": "apm", "versions": [{"status": "affected", "version": "< 0.13.0"}]}]}], "published": "2026-05-15T17:16:49.090", "references": [{"url": "https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3", "source": "security-advisories@github.com"}, {"url": "https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0."}, {"lang": "es", "value": "Microsoft APM es un gestor de dependencias de c\u00f3digo abierto, impulsado por la comunidad, para agentes de IA. Antes de 0.13.0, Microsoft APM contiene una falla de l\u00edmite en la extracci\u00f3n de archivos espec\u00edfica de Windows en la sonda de paquete heredado utilizada por apm install [bundle] en tiempos de ejecuci\u00f3n de Python 3.10 y 3.11 compatibles. Cuando a apm install se le da un .tar.gz local que no es reconocido como un paquete con formato de plugin, APM sondea si es un paquete apm heredado con formato --format. En versiones de Python anteriores a la 3.12, esa sonda extrae miembros tar no confiables directamente con tar.extractall() sin rechazar nombres de miembros absolutos de Windows como D:/.... Esta vulnerabilidad est\u00e1 corregida en 0.13.0."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security-advisories@github.com"}