CVE-2026-44641

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44641", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T15:30:10.875Z", "datePublished": "2026-05-15T16:00:23.198Z", "dateUpdated": "2026-05-15T17:49:00.985Z"}, "containers": {"cna": {"title": "Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr"}], "affected": [{"vendor": "microsoft", "product": "apm", "versions": [{"version": "< 0.8.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T16:00:23.198Z"}, "descriptions": [{"lang": "en", "value": "Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12."}], "source": {"advisory": "GHSA-xhrw-5qxx-jpwr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-15T17:48:37.067375Z", "id": "CVE-2026-44641", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T17:49:00.985Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44641", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T15:30:10.875Z", "datePublished": "2026-05-15T16:00:23.198Z", "dateUpdated": "2026-05-15T17:49:00.985Z"}, "containers": {"cna": {"title": "Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr"}], "affected": [{"vendor": "microsoft", "product": "apm", "versions": [{"version": "< 0.8.12", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T16:00:23.198Z"}, "descriptions": [{"lang": "en", "value": "Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12."}], "source": {"advisory": "GHSA-xhrw-5qxx-jpwr", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44641", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-15T17:48:37.067375Z"}}}], "references": [{"url": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T17:48:55.309Z"}}]}}

{"affected": [{"affectedData": [{"product": "apm", "vendor": "microsoft", "versions": [{"status": "affected", "version": "< 0.8.12"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12."}, {"lang": "es", "value": "Microsoft APM es un gestor de dependencias de c\u00f3digo abierto, impulsado por la comunidad, para agentes de IA. Antes de la versi\u00f3n 0.8.12, Microsoft APM normaliza los plugins del marketplace copiando los componentes del plugin referenciados en plugin.json en .apm/. Los campos del manifiesto agents, skills, commands y hooks est\u00e1n controlados por el atacante, pero la implementaci\u00f3n no garantiza que esas rutas permanezcan dentro del directorio del plugin. Un plugin malicioso puede, por lo tanto, usar rutas absolutas o rutas de recorrido .. / para copiar archivos o directorios arbitrarios legibles del host desde la m\u00e1quina del instalador durante apm install. Esta vulnerabilidad se corrige en la versi\u00f3n 0.8.12."}], "id": "CVE-2026-44641", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44641", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-15T17:48:37.067375Z", "version": "2.0.3"}}]}, "published": "2026-05-15T17:16:47.633", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/microsoft/apm/security/advisories/GHSA-xhrw-5qxx-jpwr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.8.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "apm", "vendor": "microsoft"}], "created": "2026-05-15T18:00:05.567309+00:00", "updated": "2026-05-17T17:01:31.983891+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$apm"]}