CVE-2026-45539

Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.

Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.

Summary

Two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links.

A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories.

The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default.

This was reproduced via the standard owner/repo#tag install flow against a real bare git repository. No --force or special flags were used.

Affected code

Sinks

• src/apm_cli/integration/prompt_integrator.py
PromptIntegrator.find_prompt_files: package_path.glob("*.prompt.md") and apm_prompts.glob("*.prompt.md")
  No symlink filter.

• src/apm_cli/integration/prompt_integrator.py
PromptIntegrator.copy_prompt: source.read_text("utf-8")

• src/apm_cli/integration/agent_integrator.py
AgentIntegrator.find_agent_files: package_path.glob("*.agent.md"), apm_agents.rglob("*.agent.md"), apm_agents.rglob("*.md"), apm_chatmodes.glob("*.chatmode.md")
  No symlink filter.

• src/apm_cli/integration/agent_integrator.py
AgentIntegrator.copy_agent: source.read_text("utf-8")

• src/apm_cli/integration/agent_integrator.py
_write_codex_agent: source.read_text("utf-8"); resolved bytes are embedded into developer_instructions of the generated .codex/agents/<name>.toml

• src/apm_cli/integration/agent_integrator.py
_write_windsurf_agent_skill: same dereference pattern; resolved bytes land in .windsurf/skills/<name>/SKILL.md

Safe pattern already present in the codebase

• src/apm_cli/integration/base_integrator.py
BaseIntegrator.find_files_by_glob() rejects:
  • symlinks via f.is_symlink()
  • hardlinks via f.stat().st_nlink > 1
  • resolved paths escaping the package root

This helper is already used by InstructionIntegrator.find_instruction_files.

Documented contract that the affected integrators violate

In src/apm_cli/install/phases/local_content.py, _copy_local_package documents the intent of preserving symlinks in apm_modules/:

This is security-relevant and not intended behavior because the codebase already documents that symlinks preserved in apm_modules/ are supposed to remain inert unless a consumer follows them safely. The affected integrators are exactly those consumer paths, and they dereference the symlink without sandboxing or symlink checks. That makes this an implementation gap, not expected design.

The affected integrators are the consumer tools that follow the link without sandboxing.

Reproducer

This proof of concept is localhost-only and uses a sentinel file, not a real secret.

It uses a real bare git repository and git config insteadOf so the install path is the same one APM uses for real GitHub clones (Repo.clone_from). No network access is required.

# 0. Clean slate
rm -rf /tmp/poc /tmp/poc_secret /tmp/poc_home
mkdir -p /tmp/poc/{remote_bare,victim_project,work_repo} /tmp/poc_home

# 1. Sentinel file outside the project and outside the package
echo 'APM-AUDIT-SENTINEL-X7Y2Q9-NOT-A-REAL-CREDENTIAL' > /tmp/poc_secret

# 2. Build a benign-looking APM package with two symlinks in it
cd /tmp/poc/work_repo
git init -q -b main .
git config user.email [email protected]
git config user.name 'PoC'

cat > apm.yml <<'YML'
name: helpful-agents
version: 1.0.0
description: Helpful AI agent collection
YML

mkdir -p .apm/agents .apm/prompts

cat > .apm/agents/helper.agent.md <<'AGENT'
---
name: helper
description: A helpful assistant
---
You are a helpful assistant.
AGENT

ln -s…

Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.

Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default. This vulnerability is fixed in 0.13.0.

Summary

Two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links.

A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories.

The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default.

This was reproduced via the standard owner/repo#tag install flow against a real bare git repository. No --force or special flags were used.

Affected code

Sinks

• src/apm_cli/integration/prompt_integrator.py
PromptIntegrator.find_prompt_files: package_path.glob("*.prompt.md") and apm_prompts.glob("*.prompt.md")
  No symlink filter.

• src/apm_cli/integration/prompt_integrator.py
PromptIntegrator.copy_prompt: source.read_text("utf-8")

• src/apm_cli/integration/agent_integrator.py
AgentIntegrator.find_agent_files: package_path.glob("*.agent.md"), apm_agents.rglob("*.agent.md"), apm_agents.rglob("*.md"), apm_chatmodes.glob("*.chatmode.md")
  No symlink filter.

• src/apm_cli/integration/agent_integrator.py
AgentIntegrator.copy_agent: source.read_text("utf-8")

• src/apm_cli/integration/agent_integrator.py
_write_codex_agent: source.read_text("utf-8"); resolved bytes are embedded into developer_instructions of the generated .codex/agents/<name>.toml

• src/apm_cli/integration/agent_integrator.py
_write_windsurf_agent_skill: same dereference pattern; resolved bytes land in .windsurf/skills/<name>/SKILL.md

Safe pattern already present in the codebase

• src/apm_cli/integration/base_integrator.py
BaseIntegrator.find_files_by_glob() rejects:
  • symlinks via f.is_symlink()
  • hardlinks via f.stat().st_nlink > 1
  • resolved paths escaping the package root

This helper is already used by InstructionIntegrator.find_instruction_files.

Documented contract that the affected integrators violate

In src/apm_cli/install/phases/local_content.py, _copy_local_package documents the intent of preserving symlinks in apm_modules/:

This is security-relevant and not intended behavior because the codebase already documents that symlinks preserved in apm_modules/ are supposed to remain inert unless a consumer follows them safely. The affected integrators are exactly those consumer paths, and they dereference the symlink without sandboxing or symlink checks. That makes this an implementation gap, not expected design.

The affected integrators are the consumer tools that follow the link without sandboxing.

Reproducer

This proof of concept is localhost-only and uses a sentinel file, not a real secret.

It uses a real bare git repository and git config insteadOf so the install path is the same one APM uses for real GitHub clones (Repo.clone_from). No network access is required.

# 0. Clean slate
rm -rf /tmp/poc /tmp/poc_secret /tmp/poc_home
mkdir -p /tmp/poc/{remote_bare,victim_project,work_repo} /tmp/poc_home

# 1. Sentinel file outside the project and outside the package
echo 'APM-AUDIT-SENTINEL-X7Y2Q9-NOT-A-REAL-CREDENTIAL' > /tmp/poc_secret

# 2. Build a benign-looking APM package with two symlinks in it
cd /tmp/poc/work_repo
git init -q -b main .
git config user.email [email protected]
git config user.name 'PoC'

cat > apm.yml <<'YML'
name: helpful-agents
version: 1.0.0
description: Helpful AI agent collection
YML

mkdir -p .apm/agents .apm/prompts

cat > .apm/agents/helper.agent.md <<'AGENT'
---
name: helper
description: A helpful assistant
---
You are a helpful assistant.
AGENT

ln -s…

Summary

Two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transparently following symbolic links.

A symlink committed inside a remote APM dependency under .apm/prompts/<x>.prompt.md or .apm/agents/<x>.agent.md is preserved verbatim into apm_modules/ on clone and then dereferenced during integration, with the resolved content written as a regular file into the project's deploy directories.

The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this. The deploy roots are not added to the auto-generated .gitignore, so the resulting files are staged by git add by default.

This was reproduced via the standard owner/repo#tag install flow against a real bare git repository. No --force or special flags were used.

Affected code

Sinks

• src/apm_cli/integration/prompt_integrator.py
PromptIntegrator.find_prompt_files: package_path.glob("*.prompt.md") and apm_prompts.glob("*.prompt.md")
  No symlink filter.

• src/apm_cli/integration/prompt_integrator.py
PromptIntegrator.copy_prompt: source.read_text("utf-8")

• src/apm_cli/integration/agent_integrator.py
AgentIntegrator.find_agent_files: package_path.glob("*.agent.md"), apm_agents.rglob("*.agent.md"), apm_agents.rglob("*.md"), apm_chatmodes.glob("*.chatmode.md")
  No symlink filter.

• src/apm_cli/integration/agent_integrator.py
AgentIntegrator.copy_agent: source.read_text("utf-8")

• src/apm_cli/integration/agent_integrator.py
_write_codex_agent: source.read_text("utf-8"); resolved bytes are embedded into developer_instructions of the generated .codex/agents/<name>.toml

• src/apm_cli/integration/agent_integrator.py
_write_windsurf_agent_skill: same dereference pattern; resolved bytes land in .windsurf/skills/<name>/SKILL.md

Safe pattern already present in the codebase

• src/apm_cli/integration/base_integrator.py
BaseIntegrator.find_files_by_glob() rejects:
  • symlinks via f.is_symlink()
  • hardlinks via f.stat().st_nlink > 1
  • resolved paths escaping the package root

This helper is already used by InstructionIntegrator.find_instruction_files.

Documented contract that the affected integrators violate

In src/apm_cli/install/phases/local_content.py, _copy_local_package documents the intent of preserving symlinks in apm_modules/:

This is security-relevant and not intended behavior because the codebase already documents that symlinks preserved in apm_modules/ are supposed to remain inert unless a consumer follows them safely. The affected integrators are exactly those consumer paths, and they dereference the symlink without sandboxing or symlink checks. That makes this an implementation gap, not expected design.

The affected integrators are the consumer tools that follow the link without sandboxing.

Reproducer

This proof of concept is localhost-only and uses a sentinel file, not a real secret.

It uses a real bare git repository and git config insteadOf so the install path is the same one APM uses for real GitHub clones (Repo.clone_from). No network access is required.

# 0. Clean slate
rm -rf /tmp/poc /tmp/poc_secret /tmp/poc_home
mkdir -p /tmp/poc/{remote_bare,victim_project,work_repo} /tmp/poc_home

# 1. Sentinel file outside the project and outside the package
echo 'APM-AUDIT-SENTINEL-X7Y2Q9-NOT-A-REAL-CREDENTIAL' > /tmp/poc_secret

# 2. Build a benign-looking APM package with two symlinks in it
cd /tmp/poc/work_repo
git init -q -b main .
git config user.email [email protected]
git config user.name 'PoC'

cat > apm.yml <<'YML'
name: helpful-agents
version: 1.0.0
description: Helpful AI agent collection
YML

mkdir -p .apm/agents .apm/prompts

cat > .apm/agents/helper.agent.md <<'AGENT'
---
name: helper
description: A helpful assistant
---
You are a helpful assistant.
AGENT

ln -s…