medium5.5
CVE-2026-46383
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
Impact
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apm-cli | <= 0.12.4 | 0.13.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-mq5j-pw29-jcv3
- https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3
- https://github.com/microsoft/apm/commit/77d1dda8303c8d7ccb6148788a6274fdece98499
- https://github.com/microsoft/apm/releases/tag/v0.13.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-46383