{
  "cve_id": "CVE-2026-45539",
  "verdict": "vulnerable_and_fix_verified",
  "confidence": "high",
  "affected_component": "apm-cli (PyPI package)",
  "affected_versions": "0.5.4 - 0.12.4 (inclusive)",
  "fixed_versions": "0.13.0+",
  "reproduction_successful": true,
  "vulnerable_behavior_observed": true,
  "fix_behavior_observed": true,
  "reproduction_idempotent": true,
  "evidence_summary": "The reproduction script demonstrated that apm-cli 0.12.4 (vulnerable) follows symbolic links during prompt integration, resulting in 2 prompts being integrated from a malicious package containing a symlink (evil.prompt.md -> sentinel.txt). With apm-cli 0.13.0 (fixed), only 1 legitimate prompt was integrated, and the symlink was rejected, preventing arbitrary file disclosure.",
  "log_files": {
    "vulnerable_install": "logs/vulnerable_install.log",
    "fixed_install": "logs/fixed_install.log"
  },
  "key_evidence": {
    "vulnerable": "Log shows '2 prompts integrated -> .github/prompts/' for the malicious package, indicating the symlink was followed and the target file content was copied into the consumer project tree.",
    "fixed": "Log shows '1 prompts integrated -> .github/prompts/' for the same malicious package, indicating the symlink was rejected. Post-install file listing confirms evil.prompt.md is absent from .github/prompts/."
  },
  "deliverables": {
    "reproduction_script": "repro/reproduction_steps.sh",
    "rca_report": "repro/rca_report.md",
    "validation_verdict": "repro/validation_verdict.json"
  },
  "notes": "The vulnerability is a symlink-following issue in APM package primitive file integration. A malicious dependency can include a symlink under .apm/prompts/ pointing to an arbitrary host path. During 'apm install', the CLI dereferences the symlink, reads the target file's contents, and copies them into the consuming project's installed-package tree. The fix in v0.13.0 adds symlink/hardlink rejection and path containment checks."
}