Microsoft APM, an open-source dependency manager for AI agents, versions 0.5.4 to 0.12.4 contain a vulnerability (CVE-2026-45539) involving improper link resolution (CWE-59). Two integrators in apm-cli enumerate package files using Path.glob() and Path.rglob(), which follow symbolic links transparently. Symlinks committed inside remote dependencies under specific directories (.apm/prompts/ or .apm/agents/) are preserved and dereferenced during integration, causing the resolved content to be written as regular files into deployment directories. This process bypasses content hash verification, security scans, and audit checks. Additionally, deployment directories are not added to .gitignore, causing these files to be staged by default in git. The vulnerability is fixed starting with version 0.13.0.

An attacker can craft symbolic links inside remote APM dependencies that, when integrated, cause arbitrary files to be written into deployment directories as regular files. This could lead to unintended disclosure of sensitive data or inclusion of malicious content in the project. The vulnerability does not affect confidentiality, integrity, or availability directly via exploitation but can cause information exposure (CWE-200) due to improper link following. The CVSS score is 7.4 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high confidentiality impact. No known exploits have been reported in the wild.

This vulnerability is fixed in Microsoft APM version 0.13.0. Users should upgrade to version 0.13.0 or later to remediate this issue. Until upgrading, users should carefully review and sanitize remote dependencies to avoid malicious symbolic links. Since no official patch link or advisory is provided, users should monitor the official Microsoft APM repository for the release of version 0.13.0 and apply the update promptly.