CVE-2026-101079: agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision
A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/scanner/analyzers/context.js. Performing a manipulation results in reliance on untrusted inputs in a security decision. The attack must be initiated from a local position. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and low privileges, and user interaction is required. The CVSS vector indicates no confidentiality impact and a low integrity impact.
Which versions are affected?
agentverus-scanner versions up to and including 0.8.1 are identified as affected.
Is public exploit information available?
Yes. The exploit has been made public, increasing the likelihood that it could be used by someone with the required local access and privileges.
Has a fix or vendor response been reported?
No fix is stated in the available information. The project was notified through an issue report but had not responded at the time of reporting.