Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

microsoft/apm

              main @ c550b36
            

116

Fixes

CVEs

HIGH

Peak severity

28.6%

Coverage

Highlights

Path Traversal: 52 prior fixes. Scrutinize any change in this area.

src/apm_cli/commands/install.py: most-fixed (6 issues). Treat as high-risk during review.

46 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Unsafe directory boundary verification during legacy archive extraction and symlink resolution can allow malicious packages to overwrite arbitrary host files or traverse the filesystem boundary on Windows and Linux systems.

Auth Bypass: Policy document inheritance logic could silently drop organizational restrictions (such as registry_source, bin_deploy, and unmanaged_files) or overlook empty repository-level lists, leaving systems running on insecure defaults.

Remote Code Execution: Invoking subprocess git execution on untrusted upstream repositories without explicitly disabling core hooks and submodule recursion permits immediate local code execution during normal caching operations.