CVE-2026-84809: Tencent AI-Infra-Guard RCE Vulnerability

CVE-2026-84809 Overview

CVE-2026-84809 is an analysis bypass vulnerability in Tencent AI-Infra-Guard's skill-scan component. The scanner hardcodes __pycache__ directories and .pyc, .pyo, and .pyd extensions into skip lists across multiple scanning surfaces. As a result, compiled Python bytecode is never surfaced to the auditing logic. Attackers can package a benign .py source file alongside a malicious compiled bytecode artifact. CPython executes the .pyc at import time independently of the .py source under PEP 552 UNCHECKED_HASH. The scanner returns a safe verdict while the operator installs a skill that executes attacker-controlled code. The weakness is classified as [CWE-693] Protection Mechanism Failure.

Critical Impact
A malicious skill can bypass Tencent AI-Infra-Guard analysis and achieve code execution in the operator's environment after installation.

Affected Products

Tencent AI-Infra-Guard skill-scan component
Tencent AI-Infra-Guard v4.6.0
Prior releases containing the hardcoded bytecode exclusion lists in dir_actions.py, pre_scan.py, and agent.py

Discovery Timeline

2026-09-02 - CVE-2026-84809 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84809

Vulnerability Analysis

The skill-scan component of Tencent AI-Infra-Guard is designed to audit third-party skills before an operator installs them. Its file discovery routines build a directory tree and a scan list of source files intended for downstream analysis by an auditing LLM. Those routines exclude compiled Python artifacts through hardcoded skip sets. The exclusion assumes compiled bytecode is derivative of on-disk source. That assumption is incorrect. CPython imports .pyc files directly when they exist under __pycache__, and PEP 552 defines an UNCHECKED_HASH mode where the interpreter never validates the source hash. An attacker can ship a decoy .py file that appears benign and pair it with a .pyc containing malicious logic. The scanner reads only the decoy, produces a SAFE verdict, and the operator imports the skill.

Root Cause

The root cause is a protection mechanism failure. In skill-scan/skill_scan/tools/dir/dir_actions.py, _IGNORED_DIRS included __pycache__ and _IGNORED_EXTS included .pyc, .pyo, and .pyd. Equivalent skip logic existed in pre_scan.py and in _TREE_SKIP_DIRS inside agent.py. The scanner's threat model treated compiled artifacts as non-executable clutter rather than as an independent import surface.

Attack Vector

Exploitation requires an operator to install an attacker-supplied skill through the normal skill-distribution workflow. The attacker publishes a skill containing a legitimate-looking .py module plus a crafted __pycache__/<module>.cpython-XY.pyc. Tencent AI-Infra-Guard scans the skill directory, skips the bytecode, and reports no findings. When the operator imports the module, CPython loads the .pyc and executes attacker code. User interaction from the operator is required, but no authentication or privilege on the target is needed by the attacker.

python

# Patch: skill-scan/skill_scan/tools/dir/dir_actions.py
 from skill_scan.utils.loging import logger
 from skill_scan.utils.tool_context import ToolContext

-_IGNORED_DIRS = {'.git', '__pycache__', 'node_modules', '.venv', 'venv', '.idea', '.mypy_cache'}
-_IGNORED_EXTS = {'.pyc', '.pyo', '.pyd'}
+_IGNORED_DIRS = {'.git', 'node_modules', '.venv', 'venv', '.idea', '.mypy_cache'}
+# NOTE: We deliberately NO LONGER ignore `__pycache__` and compiled extensions
+# (.pyc/.pyo/.pyd). CPython executes `.pyc` at import time independently of any
+# `.py` source (see PEP 552 UNCHECKED_HASH), so a malicious skill could ship a
+# clean `.py` decoy plus a malicious `.pyc` and receive a false SAFE verdict.
+# Tracked as GitHub Issue #531. Compiled artifacts are surfaced with a
+# `[compiled-bytecode]` marker so the auditing LLM can see them.
+_IGNORED_EXTS = set()
+_COMPILED_EXTS = {'.pyc', '.pyo', '.pyd'}

Source: Tencent AI-Infra-Guard Commit 7e0f749. The patch removes __pycache__ from the tree-walk skip set in agent.py and clears _IGNORED_EXTS in dir_actions.py, then tags compiled artifacts with a [compiled-bytecode] marker so the auditing LLM can reason about them.

Detection Methods for CVE-2026-84809

Indicators of Compromise

Skill packages containing __pycache__ directories or loose .pyc, .pyo, or .pyd files distributed without matching, semantically equivalent .py sources.
Import-time execution of modules whose on-disk .py content does not match the observed runtime behavior.
Skill archives where module timestamps on .pyc artifacts predate or diverge from adjacent .py files.

Detection Strategies

Statically diff every .pyc in a skill against a recompile of its paired .py and flag mismatches inconsistent with PEP 552 CHECKED_HASH.
Force skill auditors to disassemble bytecode with dis or uncompyle-class tooling before granting a SAFE verdict.
Run skills in an isolated sandbox with import tracing to capture actual executed code paths, not just declared source.

Monitoring Recommendations

Log all skill installations along with a hash inventory that includes compiled bytecode, not only source files.
Alert on process execution originating from freshly installed skill directories that reference __pycache__ imports.
Track outbound network connections initiated by skill worker processes shortly after installation.

How to Mitigate CVE-2026-84809

Immediate Actions Required

Upgrade Tencent AI-Infra-Guard past commit 7e0f749e3c023e5c6ab7b32fe97b3f6f2e8aeb04, which removes the bytecode exclusions in dir_actions.py, pre_scan.py, and agent.py.
Re-audit every skill previously cleared by skill-scan, giving explicit attention to any __pycache__ contents and standalone .pyc, .pyo, or .pyd files.
Block installation of skills that ship compiled bytecode without matching source until re-audit completes.

Patch Information

The fix is delivered in the upstream commit 7e0f749, tracked in GitHub Issue #531. The patch clears _IGNORED_EXTS, drops __pycache__ from _TREE_SKIP_DIRS, and surfaces compiled artifacts to the auditing LLM with a [compiled-bytecode] marker. See the VulnCheck Advisory Analysis for the full write-up.

Workarounds

Pre-process skill directories with a wrapper that strips or explicitly rejects any .pyc, .pyo, .pyd, or __pycache__ content before invoking skill-scan.
Recompile every .py in a skill and require byte-for-byte equality with any shipped .pyc before permitting installation.
Restrict skill installation to a segmented, non-privileged runtime environment until the patched version is deployed.

bash

# Reject skills that ship compiled bytecode prior to scanning
find ./skill_package -type d -name '__pycache__' -print -exec rm -rf {} +
find ./skill_package -type f \( -name '*.pyc' -o -name '*.pyo' -o -name '*.pyd' \) -print -delete
# Then run the patched scanner
python -m skill_scan ./skill_package