CVE-2026-84811: agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode
agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious pycache entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores in both static and semantic analysis modes.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this bypass?
Users who rely on agentverus-scanner to assess companion code directories are exposed when those directories can contain attacker-supplied Python bytecode, including __pycache__ entries. The issue affects both static and semantic analysis modes.
What does an attacker need to exploit it?
The attacker needs to ship malicious compiled Python bytecode alongside benign source files in a companion code directory and have that bytecode executed through Python import behavior. No scanner privileges are required, but user interaction is required according to the supplied severity vector.
How can teams identify potentially affected scan results?
Review CERTIFIED results with high trust scores for companion code directories that include Python __pycache__ directories or compiled bytecode files. Such files may have been excluded from both static and semantic analysis.
What can be done while a fix is unavailable?
Do not treat a CERTIFIED verdict as sufficient for companion code containing Python bytecode. Reject, remove, or independently inspect compiled bytecode and __pycache__ contents before importing or executing the associated code.