Skip to content
OpenAdvisories

Package · PyPI

apm-cli

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.5
    CVE-2026-46383

    Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`

    Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on supported Python 3.10…

    Microsoft apm apm-cli PyPI
  • High 7.1
    CVE-2026-44641

    Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install

    Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, …

    Microsoft apm apm-cli PyPI