PyPI/apm-cli CVE-2026-46383: medium 5.5, EPSS 0.45%

Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`

Action: Upgrade apm-cli to 0.13.0 or later.

pip install apm-cli==0.13.0

Affected

Fixed versions

Sources

• osv: GHSA-mq5j-pw29-jcv3
• https://github.com/microsoft/apm/security/advisories/GHSA-mq5j-pw29-jcv3
• https://nvd.nist.gov/vuln/detail/CVE-2026-46383
• https://github.com/microsoft/apm/commit/77d1dda8303c8d7ccb6148788a6274fdece98499
• https://github.com/microsoft/apm
• https://github.com/microsoft/apm/releases/tag/v0.13.0

CVE-2026-46383 · published 2026-05-15T18:25:34Z · modified 2026-07-13T16:43:48.069012618Z · JSON