What is the CVSS score of CVE-2026-45539?

CVE-2026-45539 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft APM are affected by CVE-2026-45539?

Microsoft APM dependency manager versions 0.5.4 through 0.12.4 contain a symbolic link following vulnerability that allows remote attackers to read arbitrary files from affected systems through…. A patch is available.

How to fix or mitigate CVE-2026-45539?

Within 24 hours: Identify all systems running Microsoft APM versions 0.5.4-0.12.4 and isolate them from external dependency repositories; disable automatic dependency updates. Within 7 days: Audit git repositories and local file access logs for evidence of unauthorized symlink traversal; rotate credentials for any accounts with access to compromised systems. Within 30 days: Upgrade to a patched version once Microsoft releases a fix (monitor Microsoft security advisories); implement dependency validation controls and consider package allowlisting to restrict sources.

Microsoft APM CVE-2026-45539

EUVD-2026-30561 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-05-15 GitHub_M

GHSA-q5pp-gvjg-h7v4

Information Disclosure Microsoft

7.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 15, 2026 - 18:02 EUVD

Analysis Generated

May 15, 2026 - 17:15 vuln.today

DescriptionGitHub Advisory

Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.

AnalysisAI

Symbolic link following vulnerability in Microsoft APM dependency manager versions 0.5.4 to 0.12.4 allows remote attackers to read arbitrary files from the victim's system through malicious dependencies. The vulnerability occurs when APM processes symlinks in remote dependencies, following them to read local files and potentially exposing sensitive data that gets staged in git repositories. No public exploit identified at time of analysis.

Technical ContextAI

Microsoft APM (apm-cli) is an open-source dependency manager for AI agents. The vulnerability stems from CWE-59 (Improper Link Resolution Before File Access) in two primitive integrators that enumerate package files using Python's Path.glob()/Path.rglob() methods. These methods transparently follow symbolic links when reading files with Path.read_text(). The affected components are located in .apm/prompts/<x>.prompt.md and .apm/agents/<x>.agent.md paths within dependencies.

RemediationAI

Vendor-released patch: version 0.13.0 fixes this vulnerability. Users should upgrade Microsoft APM to version 0.13.0 or later immediately. As a temporary workaround, manually inspect dependencies for symbolic links before integration, particularly in .apm/prompts/ and .apm/agents/ directories. Consider implementing pre-clone validation of remote dependencies and adding deploy directories to .gitignore to prevent accidental commit of exposed files.