CVE-2026-84811
agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode
CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-84811
Publishedagentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores in both static and semantic analysis modes.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-84811 · CVE overview and exploitation status
cve-program · CVE-2026-84811
- https://github.com/agentverus/agentverus-scanner/issues/27
- https://github.com/agentverus/agentverus-scanner/blob/v0.8.1/src/scanner/companion-code.ts
- https://github.com/agentverus/agentverus-scanner/blob/v0.8.1/src/scanner/analyzers/semantic.ts
- https://github.com/agentverus/agentverus-scanner
- https://www.vulncheck.com/advisories/agentverus-scanner-companion-code-analysis-bypass-via-excluded-python-bytecode
Related changes
Linked by CVE identifierNo related changes are available here.