{"id":"CVE-2026-84811","title":"agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files","summary":"agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files. Attackers can execu…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","cwe":["CWE-693"],"published":"2026-09-02","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:43.957","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84811","references":[{"url":"https://github.com/agentverus/agentverus-scanner","label":"disclosure@vulncheck.com"},{"url":"https://github.com/agentverus/agentverus-scanner/blob/v0.8.1/src/scanner/analyzers/semantic.ts","label":"disclosure@vulncheck.com"},{"url":"https://github.com/agentverus/agentverus-scanner/blob/v0.8.1/src/scanner/companion-code.ts","label":"disclosure@vulncheck.com"},{"url":"https://github.com/agentverus/agentverus-scanner/issues/27","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/agentverus-scanner-companion-code-analysis-bypass-via-excluded-python-bytecode","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00515,"epssPercentile":0.41314,"ingestedAt":"2026-09-23T17:28:14.820Z","vendor":"agentverus","product":"agentverus-scanner","affected":["agentverus-scanner <= 0.8.1"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-03T14:09:09.167283Z"},"slug":"CVE-2026-84811","body":"## Overview\n\nagentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores in both static and semantic analysis modes.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}