Homepage

apm-cli@0.6.2

MCP configuration tool

  • latest version

    0.19.0

  • latest non vulnerable version

    0.19.0

  • first published

    9 months ago

  • latest version published

    1 days ago

  • licenses detected

  • View apm-cli package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the apm-cli package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    External Control of File Name or Path

    apm-cli is a MCP configuration tool

    Affected versions of this package are vulnerable to External Control of File Name or Path through the tar.extractall function in legacy-bundle probing on Windows systems running Python versions earlier than 3.12. An attacker can overwrite arbitrary files outside the intended extraction directory by supplying a crafted .tar.gz archive containing Windows absolute paths as member names and inducing a user to execute the install command with this archive.

    Note: This is only exploitable if the victim is running on Windows with Python 3.10 or 3.11 and executes the install command on a maliciously crafted local bundle.

    How to fix External Control of File Name or Path?

    Upgrade apm-cli to version 0.13.0 or higher.

    [,0.13.0)
    • M
    Symlink Attack

    apm-cli is a MCP configuration tool

    Affected versions of this package are vulnerable to Symlink Attack during the integration when symbolic links under certain directories are dereferenced and their target file contents are copied into project deployment directories. An attacker can access sensitive files from the host system by crafting a malicious package that includes symlinks pointing to arbitrary files, which are then read and written into the project during installation.

    How to fix Symlink Attack?

    Upgrade apm-cli to version 0.13.0 or higher.

    [0.5.4,0.13.0)
    • H
    External Control of File Name or Path

    apm-cli is a MCP configuration tool

    Affected versions of this package are vulnerable to External Control of File Name or Path through improper validation of manifest-controlled paths in the plugin.json file during the installation process. An attacker can cause arbitrary files or directories from the host system to be copied into the managed install output by specifying absolute or traversal paths in the manifest fields, potentially leading to exposure or integration of sensitive host content into the project.

    How to fix External Control of File Name or Path?

    Upgrade apm-cli to version 0.8.12 or higher.

    [,0.8.12)
    Go back to all versions of this package