https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:08:19 +0000 https://cve.radiocsirt.org/vuln/brew-apm-cve-2026-46383 <p><strong>Affected:</strong> Homebrew: apm</p> <p>Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install &lt;bundle&gt; on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0.</p> <p><strong>Affected:</strong> Homebrew: apm</p> <p>Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install &lt;bundle&gt; on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0.</p> https://cve.radiocsirt.org/vuln/brew-apm-cve-2026-46383 https://cve.radiocsirt.org/vuln/euvd-2026-319028 EUVD-2026-319028 https://cve.radiocsirt.org/vuln/euvd-2026-319028 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46383 <p>Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install &lt;bundle&gt; on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0.</p> <p>Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install &lt;bundle&gt; on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46383 https://cve.radiocsirt.org/vuln/ghsa-mq5j-pw29-jcv3 <p><strong>Affected:</strong> PyPI: apm-cli</p> <p>### Summary</p> <p>Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by `apm install &lt;bundle&gt;` on supported Python 3.10 and 3.11 runtimes. When `apm install` is given a local `.tar.gz` that is not recognized as a plugin-format bundle, APM probes whether it is a legacy `--format apm` bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw `tar.extractall()` without rejecting Windows absolute member names such as `D:/...`.</p> <p>This issue is still present on the latest `main` commit at review time (`2b7a931d58a73cbfc0bcf086cea332d204075e27`) and on the latest release (`v0.12.4`). In both cases, a crafted legacy-looking tarball caused an external file to be created or overwritten outside the temporary extraction root before `apm install` finished rejecting the bundle with the expected legacy-format usage error.</p> <p>This report is scoped narrowly to Windows installations running Python 3.10 or 3.11.</p> <p>### Details</p> <p>The broken trust boundary is the boundary between an untrusted local bundle artifact and the host filesystem state that APM is allowed to modify while probing that artifact. The attacker-controlled input is the tar member name inside the `.tar.gz` bundle. A crafted archive can include a member whose name is a Windows absolute path such as `D:/apm/run-main-install/outside/legacy-probe-outside-main.txt`.</p> <p>The current install caller path still reaches the legacy probe for `.tar.gz` inpu…</p> <p><strong>Affected:</strong> PyPI: apm-cli</p> <p>### Summary</p> <p>Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by `apm install &lt;bundle&gt;` on supported Python 3.10 and 3.11 runtimes. When `apm install` is given a local `.tar.gz` that is not recognized as a plugin-format bundle, APM probes whether it is a legacy `--format apm` bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw `tar.extractall()` without rejecting Windows absolute member names such as `D:/...`.</p> <p>This issue is still present on the latest `main` commit at review time (`2b7a931d58a73cbfc0bcf086cea332d204075e27`) and on the latest release (`v0.12.4`). In both cases, a crafted legacy-looking tarball caused an external file to be created or overwritten outside the temporary extraction root before `apm install` finished rejecting the bundle with the expected legacy-format usage error.</p> <p>This report is scoped narrowly to Windows installations running Python 3.10 or 3.11.</p> <p>### Details</p> <p>The broken trust boundary is the boundary between an untrusted local bundle artifact and the host filesystem state that APM is allowed to modify while probing that artifact. The attacker-controlled input is the tar member name inside the `.tar.gz` bundle. A crafted archive can include a member whose name is a Windows absolute path such as `D:/apm/run-main-install/outside/legacy-probe-outside-main.txt`.</p> <p>The current install caller path still reaches the legacy probe for `.tar.gz` inpu…</p> https://cve.radiocsirt.org/vuln/ghsa-mq5j-pw29-jcv3 https://cve.radiocsirt.org/vuln/pysec-2026-2378 <p><strong>Affected:</strong> PyPI: apm-cli</p> <p>### Summary</p> <p>Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by `apm install &lt;bundle&gt;` on supported Python 3.10 and 3.11 runtimes. When `apm install` is given a local `.tar.gz` that is not recognized as a plugin-format bundle, APM probes whether it is a legacy `--format apm` bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw `tar.extractall()` without rejecting Windows absolute member names such as `D:/...`.</p> <p>This issue is still present on the latest `main` commit at review time (`2b7a931d58a73cbfc0bcf086cea332d204075e27`) and on the latest release (`v0.12.4`). In both cases, a crafted legacy-looking tarball caused an external file to be created or overwritten outside the temporary extraction root before `apm install` finished rejecting the bundle with the expected legacy-format usage error.</p> <p>This report is scoped narrowly to Windows installations running Python 3.10 or 3.11.</p> <p>### Details</p> <p>The broken trust boundary is the boundary between an untrusted local bundle artifact and the host filesystem state that APM is allowed to modify while probing that artifact. The attacker-controlled input is the tar member name inside the `.tar.gz` bundle. A crafted archive can include a member whose name is a Windows absolute path such as `D:/apm/run-main-install/outside/legacy-probe-outside-main.txt`.</p> <p>The current install caller path still reaches the legacy probe for `.tar.gz` inpu…</p> <p><strong>Affected:</strong> PyPI: apm-cli</p> <p>### Summary</p> <p>Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by `apm install &lt;bundle&gt;` on supported Python 3.10 and 3.11 runtimes. When `apm install` is given a local `.tar.gz` that is not recognized as a plugin-format bundle, APM probes whether it is a legacy `--format apm` bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw `tar.extractall()` without rejecting Windows absolute member names such as `D:/...`.</p> <p>This issue is still present on the latest `main` commit at review time (`2b7a931d58a73cbfc0bcf086cea332d204075e27`) and on the latest release (`v0.12.4`). In both cases, a crafted legacy-looking tarball caused an external file to be created or overwritten outside the temporary extraction root before `apm install` finished rejecting the bundle with the expected legacy-format usage error.</p> <p>This report is scoped narrowly to Windows installations running Python 3.10 or 3.11.</p> <p>### Details</p> <p>The broken trust boundary is the boundary between an untrusted local bundle artifact and the host filesystem state that APM is allowed to modify while probing that artifact. The attacker-controlled input is the tar member name inside the `.tar.gz` bundle. A crafted archive can include a member whose name is a Windows absolute path such as `D:/apm/run-main-install/outside/legacy-probe-outside-main.txt`.</p> <p>The current install caller path still reaches the legacy probe for `.tar.gz` inpu…</p> https://cve.radiocsirt.org/vuln/pysec-2026-2378