https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 05:14:08 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44641 <p><strong>Affected:</strong> microsoft apm</p> <p>Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer&#39;s machine during apm install. This vulnerability is fixed in 0.8.12.</p> <p><strong>Affected:</strong> microsoft apm</p> <p>Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer&#39;s machine during apm install. This vulnerability is fixed in 0.8.12.</p> https://cve.radiocsirt.org/vuln/cve-2026-44641