Security: microsoft/apm
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`GHSA-mq5j-pw29-jcv3 published
May 11, 2026 by danielmeppielModerate -
Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project treeGHSA-q5pp-gvjg-h7v4 published
May 11, 2026 by danielmeppielHigh -
plugin.json component paths escape plugin root and copy arbitrary host files during installGHSA-xhrw-5qxx-jpwr published
May 3, 2026 by danielmeppielHigh