CVE-2026-45539 Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree
Attackers can use symlinks in AI agent dependencies to copy sensitive host files into project directories during installation, bypassing security scans.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-45539?
CVE-2026-45539 is a high-severity path traversal vulnerability in microsoft apm, published on 15 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.
Which versions are affected by CVE-2026-45539?
3 open source packages ship an affected version, including apm.
| Package | Affected | Fixed in |
|---|---|---|
apm PyPI | From 0.5.4 | 0.13.0 |
apm PyPI | From 0.5.4 | 0.13.0 |
apm PyPI | From 0.5.4 | 0.13.0 |
How do I fix CVE-2026-45539?
Upgrade apm to 0.13.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-45539 being exploited?
There is no known exploitation of CVE-2026-45539 in the wild and no public exploit code.
Sources
Also known as GHSA-q5pp-gvjg-h7v4, PYSEC-2026-2377.