CVE-2026-84809
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.
Risk Assessment
Operators may install skills containing malicious bytecode that gets executed, potentially leading to system compromise.
Recommendation
Update Tencent AI-Infra-Guard to a version that also analyzes compiled bytecode files, and verify skills before installation.
Other vulnerabilities in Tencent AI-Infra-Guard
Original NVD description (English source)
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS