Microsoft APM, a dependency manager for AI agents, contained a path traversal vulnerability (CWE-22) in versions before 0.13.0. Specifically, when the 'apm install' command processes a local .tar.gz file not recognized as a plugin-format bundle, it attempts to identify if it is a legacy-format bundle. On Python 3.10 and 3.11, the legacy bundle probe extracts archive members using tar.extractall() without rejecting absolute Windows paths (e.g., D:/...), which can lead to files being written outside the intended directory. This vulnerability does not affect Python 3.12 or later, and it is resolved by updating to APM version 0.13.0.

The vulnerability allows an attacker who can supply a crafted local .tar.gz archive to cause the extraction process to write files to arbitrary locations on the filesystem due to improper path validation. This can lead to unauthorized modification of files (integrity impact) but does not directly affect confidentiality or availability. There are no known exploits in the wild as of the published date.

Upgrade Microsoft APM to version 0.13.0 or later, where this path traversal vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version before use. Avoid using untrusted local .tar.gz bundles with 'apm install' on affected versions and Python runtimes prior to 3.12 until upgraded. Patch status is not explicitly confirmed beyond the fix in version 0.13.0; check vendor sources for the latest remediation guidance.