Symlink Vulnerability in Microsoft APM Dependency Manager

CVE-2026-45539

What is CVE-2026-45539?

Microsoft APM, an open-source dependency manager for AI agents, exhibits a vulnerability in versions 0.5.4 to 0.12.4 that allows symlink exploitation. The issue involves primitive integrators in apm-cli that enumerate package files with bare Path.glob() and Path.rglob() calls. These methods read matches via Path.read_text(), which can lead to the transparency of symbolic links. Specifically, symlinks within remote APM dependencies are preserved and dereferenced during integration, resulting in their resolved content being written into deploy directories of the project. Importantly, the security mechanisms in place do not detect this, including the package content_hash and pre-deploy SecurityGate scans. Furthermore, affected files are staged by default due to being absent in the auto-generated .gitignore. Version 0.13.0 has addressed this vulnerability.

References