CVE-2026-84811
7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Summary
agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious pycache entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores in both static and semantic analysis modes.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| agentverus | agentverus-scanner | 0 <= 0.8.1 | affected |
Weaknesses
- CWE-693: Protection Mechanism Failure
References
- https://github.com/agentverus/agentverus-scanner/issues/27
- https://github.com/agentverus/agentverus-scanner/blob/v0.8.1/src/scanner/companion-code.ts
- https://github.com/agentverus/agentverus-scanner/blob/v0.8.1/src/scanner/analyzers/semantic.ts
- https://github.com/agentverus/agentverus-scanner
- https://www.vulncheck.com/advisories/agentverus-scanner-companion-code-analysis-bypass-via-excluded-python-bytecode
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.