CVE-2026-84811

MediumCVSS 6.5

Published: 02/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

22th percentile - higher than 22% of all known CVEs

Summary

The agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores.

Risk Assessment

The risk is that malicious code can be delivered and executed in the environment even though the security scanner marks it as safe, potentially leading to system compromise.

Recommendation

Update agentverus-scanner to a version that analyzes bytecode files, and manually inspect __pycache__ directories in delivered packages.

Other vulnerabilities in agentverus-scanner

CVE-2026-101079Low
A vulnerability in agentverus-scanner up to 0.8.1 affects the isSecurityDefenseSkill function in dist/scanner/analyzers/context.js. Manipulation results in reliance on untrusted inputs in a security decision, and the attack must be initiated from a local position. The exploit has been made public and could be used; the project has not responded to the issue report.

Original NVD description (English source)

agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores in both static and semantic analysis modes.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS