HighVulnerability
CVE-2026-45539: Microsoft APM symlink following during prompt and agent file integration
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-45539
- Published
- Record updated
- Affected
- apm >= 0.5.4, <= 0.12.4
- Fixed in
- 0.13.0
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 1.1%
Summary
From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with Path.glob() and Path.rglob() and read matches with Path.read_text(), following symbolic links transparently. A symlink committed inside a remote APM dependency under .apm/prompts/ or .apm/agents/ is preserved into apm_modules/ on clone, then dereferenced during integration, and the resolved content is written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this.
Mitigation
Fixed in 0.13.0.
Topics
Related items
- HighGHSA-h4xc-3qfq-jf93: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpointSame vendor · GitHub Advisory Database
- LowGHSA-6gw6-rv2g-25mg: Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsSame vendor · GitHub Advisory Database
- MediumCVE-2026-89278: GPTranslate WordPress plugin exposes plaintext API key to unauthenticated usersSame vendor · NVD/CVE Database
- HighCVE-2026-85887: M365 Copilot incorrect permission assignment allows information disclosureSame vendor · NVD/CVE Database
- CriticalCVE-2026-85885: M365 Copilot command injection allows privilege elevation over a networkSame vendor · NVD/CVE Database