Skip to content
OpenAdvisories

Package · PyPI

apm-cli

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-44641

    Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install

    Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, …

    Microsoft apm apm-cli PyPI