Executive brief
Microsoft APM CLI is a tool used to manage and install marketplace plugins. A vulnerability in the installation process allows a malicious plugin to copy sensitive files from the user's computer into the project directory. This could lead to the accidental exposure of private data or the unauthorized modification of project files when a user installs a compromised plugin.
Technical details
A path traversal vulnerability exists in Microsoft APM CLI (apm-cli) versions 0.8.11 and earlier. The `_resolve_sources()` function in `plugin_parser.py` joins manifest-controlled paths (agents, skills, commands, and hooks) with the plugin root without verifying that the resulting paths remain within the plugin directory. An attacker can use absolute paths or `../` sequences in a `plugin.json` file to reference arbitrary files on the host system. During `apm install`, these files are copied into the `.apm/` directory and may be automatically integrated into the `.github/prompts/` directory, leading to local file disclosure or integrity violations. The issue is fixed in version 0.8.12.
Affected products
- Microsoft apm-cli <= 0.8.11
Timeline
- 2026-05-03: disclosed: Initial disclosure to Microsoft
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-15: patched: NVD publication and patch confirmation