CVE-2026-44641

{
  "id": "CVE-2026-44641",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-15T17:16:47.633",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12."
    },
    {
      "lang": "es",
      "value": "Microsoft APM es un gestor de dependencias de código abierto, impulsado por la comunidad, para agentes de IA. Antes de la versión 0.8.12, Microsoft APM normaliza los plugins del marketplace copiando los componentes del plugin referenciados en plugin.json en .apm/. Los campos del manifiesto agents, skills, commands y hooks están controlados por el atacante, pero la implementación no garantiza que esas rutas permanezcan dentro del directorio del plugin. Un plugin malicioso puede, por lo tanto, usar rutas absolutas o rutas de recorrido .. /  para copiar archivos o directorios arbitrarios legibles del host desde la máquina del instalador durante apm install. Esta vulnerabilidad se corrige en la versión 0.8.12."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "microsoft",
          "product": "apm",
          "versions": [
            {
              "version": "< 0.8.12",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-15T17:48:37.067375Z",
          "id": "CVE-2026-44641",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}