CVE-2026-101079

LowCVSS 2.8

Published: 28/09/2026(UTC)Updated: 01/10/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

A vulnerability in agentverus-scanner up to 0.8.1 affects the isSecurityDefenseSkill function in dist/scanner/analyzers/context.js. Manipulation results in reliance on untrusted inputs in a security decision, and the attack must be initiated from a local position. The exploit has been made public and could be used; the project has not responded to the issue report.

Risk Assessment

A local attacker could influence security decisions made by the scanner, potentially leading to incorrect analysis results or bypassing protective mechanisms. Since the exploit is public, the risk of exploitation is increased.

Recommendation

Given the project's lack of response, consider discontinuing use of agentverus-scanner or applying your own fixes, and restrict local access to the tool to trusted users.

Other vulnerabilities in agentverus-scanner

CVE-2026-84811Medium
The agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores.

Original NVD description (English source)

A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/scanner/analyzers/context.js. Performing a manipulation results in reliance on untrusted inputs in a security decision. The attack must be initiated from a local position. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS