CVE-2026-44641 — Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install

Description (CNA)

Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.

Affected (CNA)

Vendor / product	Versions
microsoft / apm	affected < 0.8.12

CWE

CWE-22, CWE-73

References

https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr