CVE-2026-84809

MediumCVSS 6.5/10Last modified Sep 24, 2026

Description

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-693

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-84819.9IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /CVE-2026-848106.5claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python CVE-2026-848116.5agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scan CVE-2026-848127.1Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.CVE-2026-848139.3Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.CVE-2026-848149.8Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.CVE-2026-848155.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. T CVE-2026-848167.1Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.CVE-2026-848177.1Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.CVE-2026-848187.1Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.CVE-2026-848197.1Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.CVE-2026-84824.3A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (incl