Path Traversal in Microsoft APM Plugin Normalization

Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A malicious plugin can therefore use absolute paths or ../ traversal paths to copy arbitrary readable host files or directories from the installer's machine during apm install. This vulnerability is fixed in 0.8.12.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Microsoft APM is a dependency manager for AI agents that processes plugin manifests to organize components into a standardized directory structure. This vulnerability exploits insufficient path validation during plugin normalization—attackers can embed absolute paths or directory traversal sequences (../) in manifest fields like agents, skills, commands, and hooks to copy arbitrary readable files from the host system outside the intended plugin directory. This affects any organization using Microsoft APM versions prior to 0.8.12 to manage AI agent dependencies, particularly those in regulated environments where unauthorized file disclosure could expose sensitive configurations, credentials, or system information.

Casky's 331 matching skills detect the attack patterns underlying this vulnerability by analyzing MITRE techniques TA0001 (Initial Access) and TA0007 (Discovery). Practitioners would observe detections flagging suspicious plugin.json manifests containing path traversal indicators (../, absolute paths starting with / or drive letters), anomalous file copy operations reading from unexpected system directories, and manifest validation gaps where field values bypass canonicalization checks. Claude AI's extended reasoning across these 754 mapped security skills enables practitioners to correlate plugin installation events with unauthorized file reads, identify which host files were targeted, and trace the chain from malicious manifest crafting through arbitrary file disclosure—moving beyond simple signature detection to understand adversary intent and lateral movement risks in their AI agent infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-44641.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-44641

Casky has 331 skills that investigate the attack patterns behind CVE-2026-44641. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn