CVE-2026-45539
2 advisories.
PyPI/apm CVE-2026-45539: high 7.4
Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree
Action: Upgrade apm to 0.13.0 or later.
pip install apm==0.13.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.5.4 | 0.13.0 | - |
Fixed versions
| 0.13.0 |
Sources
- osv: GHSA-q5pp-gvjg-h7v4
- https://github.com/microsoft/apm/security/advisories/GHSA-q5pp-gvjg-h7v4
- https://nvd.nist.gov/vuln/detail/CVE-2026-45539
- https://github.com/microsoft/apm/commit/f85b9f54ad303159f9c448268eb7005c319fe02a
- https://github.com/microsoft/apm
- https://github.com/microsoft/apm/releases/tag/v0.13.0
CVE-2026-45539 · published · modified · JSON
PyPI/apm CVE-2026-45539: high 7.4
Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree
Action: Upgrade apm to 0.13.0 or later.
pip install apm==0.13.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.5.4 | 0.13.0 | - |
Fixed versions
| 0.13.0 |
Sources
- osv: PYSEC-2026-2377
- https://github.com/microsoft/apm/security/advisories/GHSA-q5pp-gvjg-h7v4
- https://nvd.nist.gov/vuln/detail/CVE-2026-45539
- https://github.com/microsoft/apm/commit/f85b9f54ad303159f9c448268eb7005c319fe02a
- https://github.com/microsoft/apm
- https://github.com/microsoft/apm/releases/tag/v0.13.0
- https://pypi.org/project/apm
- https://github.com/advisories/GHSA-q5pp-gvjg-h7v4
CVE-2026-45539 · published · modified · JSON