Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-44641 | Microsoft apm up to 0.8.11 Plugin plugin.json path traversal (GHSA-xhrw-5qxx-jpwr) https://ift.tt/kIjLJoy A vulnerability categorized as critical has been discovered in Microsoft apm up to 0.8.11. Impacted is an unknown function of the file plugin.json of the …
Post summary
The post reports CVE-2026-44641, a critical path‑traversal flaw in Microsoft apm 0.8.11, but does not provide a PoC, exploit, or patch information.