CVE-2026-44641: Microsoft APM path traversal in plugin installation

CVE-2026-44641 · Severity: high · CVSS 7.1 · Published 2026-05-15

Microsoft APM CLI is a tool used to manage and install marketplace plugins. A vulnerability in the installation process allows a malicious plugin to copy sensitive files from the user's computer into the project directory. This could lead to the accidental exposure of private data or the unauthorized modification of project files when a user installs a compromised plugin.

Technologies: Microsoft Apm-Cli. Vendors: Microsoft, PyPI.

Quick answers

Is CVE-2026-44641 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44641 being exploited in the wild.
How severe is CVE-2026-44641?
High severity, with a CVSS score of 7.1, published 15 May 2026.
Which products and versions are affected?
Microsoft Apm-Cli <= 0.8.11; apm-cli (PyPI) ECOSYSTEM:introduced=0,fixed=0.8.12.
Is there a fix for CVE-2026-44641?
Yes. apm-cli (PyPI): upgrade to 0.8.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44641 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-44641?
Check whether you run Microsoft Apm-Cli or apm-cli (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • apm-cli (PyPI): upgrade to 0.8.12 or later
    pip install "apm-cli>=0.8.12"

Technical details

A path traversal vulnerability exists in Microsoft APM CLI (apm-cli) versions 0.8.11 and earlier. The `_resolve_sources()` function in `plugin_parser.py` joins manifest-controlled paths (agents, skills, commands, and hooks) with the plugin root without verifying that the resulting paths remain within the plugin directory. An attacker can use absolute paths or `../` sequences in a `plugin.json` file to reference arbitrary files on the host system. During `apm install`, these files are copied into the `.apm/` directory and may be automatically integrated into the `.github/prompts/` directory, leading to local file disclosure or integrity violations. The issue is fixed in version 0.8.12.

Affected products

  • Microsoft apm-cli <= 0.8.11

Identifiers

  • CVE-2026-44641
  • GHSA-xhrw-5qxx-jpwr
  • PYSEC-2026-2379

Timeline

  • 2026-05-03: disclosed: Initial disclosure to Microsoft
  • 2026-05-07: advisory: GitHub Advisory published
  • 2026-05-15: patched: NVD publication and patch confirmation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.