CVE-2026-44641 Details
Description
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.
A path traversal vulnerability has been identified in Microsoft APM versions prior to 0.8.12. This issue allows malicious plugins to escape their designated directories and copy arbitrary readable files or directories from the installer's machine to a user-accessible location within the APM directory. The vulnerability arises because the plugin manifest fields 'agents', 'skills', 'commands', and 'hooks' can be controlled by attackers, and the current implementation fails to restrict these paths to within the plugin directory. Exploitation occurs during the 'apm install' process, where the copied files can trigger automatic integrations into the user's project, potentially leading to unauthorized exposure of sensitive information.
Users should update to Microsoft APM version 0.8.12 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 15, 2026CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Microsoft APM | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | New CVE Received | [email protected] |