{"data":{"id":"189533ed-ce89-465b-893f-91981bc0a6a2","title":"CVE-2026-46383: Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM…","summary":"Microsoft APM, an open-source dependency manager for AI agents, is affected by CVE-2026-46383 in versions prior to 0.13.0. On supported Python 3.10 and 3.11 runtimes on Windows, the legacy-bundle probe used by apm install <bundle> calls raw tar.extractall() on untrusted tar members without rejecting Windows absolute member names such as D:/.... The flaw is reached when a local .tar.gz that is not a plugin-format bundle is passed to apm install.","solution":"Fixed in 0.13.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46383","publishedAt":"2026-05-15T17:16:49.090Z","cveId":"CVE-2026-46383","cweIds":["CWE-22","CWE-73"],"cvssScore":"5.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["apm-cli@<= 0.12.4 (fixed: 0.13.0)"],"affectedPackageNames":["apm-cli"],"affectedPackageRefs":["pypi:apm-cli"],"affectedVendors":["Microsoft"],"affectedVendorsRaw":["Microsoft APM"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Microsoft APM archive extraction flaw in legacy-bundle probe on Windows","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","attackVector":"local","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00899,"epssCheckedAt":"2026-10-14T18:06:00.492Z","kevDateAdded":null,"advisoryAliases":["GHSA-mq5j-pw29-jcv3"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:48:19.355Z","patchAvailable":true,"disclosureDate":"2026-05-15T17:16:49.090Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}