CVE-2026-46383

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46383", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T19:53:47.922Z", "datePublished": "2026-05-15T16:04:24.050Z", "dateUpdated": "2026-05-15T17:49:11.229Z"}, "containers": {"cna": {"title": "Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3"}], "affected": [{"vendor": "microsoft", "product": "apm", "versions": [{"version": "< 0.13.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T16:04:24.050Z"}, "descriptions": [{"lang": "en", "value": "Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0."}], "source": {"advisory": "GHSA-mq5j-pw29-jcv3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-15T17:48:40.768904Z", "id": "CVE-2026-46383", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T17:49:11.229Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46383", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T17:48:40.768904Z"}}}], "references": [{"url": "https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T17:48:01.747Z"}}], "cna": {"title": "Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`", "source": {"advisory": "GHSA-mq5j-pw29-jcv3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "microsoft", "product": "apm", "versions": [{"status": "affected", "version": "< 0.13.0"}]}], "references": [{"url": "https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3", "name": "https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-15T16:04:24.050Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46383", "state": "PUBLISHED", "dateUpdated": "2026-05-15T17:49:11.229Z", "dateReserved": "2026-05-13T19:53:47.922Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-15T16:04:24.050Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "apm", "vendor": "microsoft", "versions": [{"status": "affected", "version": "< 0.13.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on supported Python 3.10 and 3.11 runtimes. When apm install is given a local .tar.gz that is not recognized as a plugin-format bundle, APM probes whether it is a legacy --format apm bundle. On Python versions earlier than 3.12, that probe extracts untrusted tar members with raw tar.extractall() without rejecting Windows absolute member names such as D:/.... This vulnerability is fixed in 0.13.0."}, {"lang": "es", "value": "Microsoft APM es un gestor de dependencias de c\u00f3digo abierto, impulsado por la comunidad, para agentes de IA. Antes de 0.13.0, Microsoft APM contiene una falla de l\u00edmite en la extracci\u00f3n de archivos espec\u00edfica de Windows en la sonda de paquete heredado utilizada por apm install [bundle] en tiempos de ejecuci\u00f3n de Python 3.10 y 3.11 compatibles. Cuando a apm install se le da un .tar.gz local que no es reconocido como un paquete con formato de plugin, APM sondea si es un paquete apm heredado con formato --format. En versiones de Python anteriores a la 3.12, esa sonda extrae miembros tar no confiables directamente con tar.extractall() sin rechazar nombres de miembros absolutos de Windows como D:/.... Esta vulnerabilidad est\u00e1 corregida en 0.13.0."}], "id": "CVE-2026-46383", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46383", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-15T17:48:40.768904Z", "version": "2.0.3"}}]}, "published": "2026-05-15T17:16:49.090", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.13.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "apm", "vendor": "microsoft"}], "created": "2026-05-15T17:30:04.549869+00:00", "updated": "2026-05-17T17:01:29.274508+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$apm"]}