microsoft/apm Security Advisories | GitStock

high2026-05-18

Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree

GHSA-q5pp-gvjg-h7v4 · CVE-2026-45539

medium2026-05-15

Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`

GHSA-mq5j-pw29-jcv3 · CVE-2026-46383

high2026-05-07

Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install

GHSA-xhrw-5qxx-jpwr · CVE-2026-44641