CVE-2026-84811: agentverus-scanner Auth Bypass Vulnerability

CVE-2026-84811 Overview

CVE-2026-84811 is a security control bypass in agentverus-scanner, an analysis tool that inspects Python packages for malicious behavior. The scanner fails to analyze compiled Python bytecode files (.pyc) inside __pycache__ companion directories. Attackers ship malicious bytecode alongside benign source files, and the scanner returns a CERTIFIED verdict with high trust scores in both static and semantic analysis modes. Python imports the malicious bytecode at runtime, executing attacker-controlled logic while the scanner's report indicates the package is safe. The weakness is categorized under [CWE-693: Protection Mechanism Failure].

Critical Impact
Attackers can achieve arbitrary Python code execution on import while agentverus-scanner reports the package as trusted, defeating supply-chain security checks.

Affected Products

agentverus-scanner v0.8.1 (semantic analyzer)
agentverus-scanner companion-code module
Downstream systems relying on agentverus-scanner CERTIFIED verdicts

Discovery Timeline

2026-09-02 - CVE-2026-84811 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84811

Vulnerability Analysis

agentverus-scanner enumerates companion source files near a package's entry points to compute a trust verdict. The companion-code module and the semantic analyzer exclude compiled Python bytecode (.pyc) files stored under __pycache__ directories from analysis. Because Python's import system loads matching .pyc files when their metadata is valid, the runtime executes bytecode that the scanner never inspected. The result is a full protection mechanism failure: the scanner emits a CERTIFIED verdict with elevated trust scores while attacker-controlled instructions run on import.

Root Cause

The root cause is an over-broad file-type exclusion in the scanner's companion code enumeration logic. Both companion-code.ts and semantic.ts at tag v0.8.1 skip __pycache__ entries and .pyc artifacts. The scanner treats these files as build cache rather than executable code. Python's loader disagrees and executes them, creating a divergence between the scanner's file model and Python's runtime import behavior. See the VulnCheck Advisory on Bypass for technical detail.

Attack Vector

An attacker publishes or distributes a Python package containing benign .py source files and malicious .pyc files under a __pycache__ directory. A victim submits the package to agentverus-scanner, which returns a CERTIFIED verdict. On first import, Python resolves the bytecode file, verifies its header, and executes the attacker's payload. Exploitation requires the user to import or execute the analyzed package, which aligns with the User Interaction: Passive requirement in the CVSS vector. See the GitHub Companion Code Module and GitHub Semantic Analyzer Code for the excluded paths.

No verified proof-of-concept code has been published. Attack details are described in prose only.

Detection Methods for CVE-2026-84811

Indicators of Compromise

Presence of .pyc files inside __pycache__ directories in packages that also ship the corresponding .py sources with mismatched compilation timestamps or hashes.
agentverus-scanner reports containing a CERTIFIED verdict for packages that include populated __pycache__ directories.
Python processes importing modules whose bytecode magic number and source hash do not match a fresh local compilation of the shipped .py file.

Detection Strategies

Recompile each shipped .py file in a clean environment and compare the resulting bytecode against any bundled .pyc file byte-for-byte.
Scan package archives for __pycache__ directories and flag any package where bytecode is present but scanner logs show no bytecode analysis events.
Cross-reference scanner verdicts with a secondary static analyzer that inspects .pyc files directly, such as uncompyle6 or decompyle3 output review.

Monitoring Recommendations

Log all Python import events at endpoints and correlate them with the file path of the loaded module to identify .pyc loads from third-party packages.
Alert on Python processes spawning child processes or opening network sockets shortly after importing a newly installed package.
Track agentverus-scanner version metadata in CI/CD pipelines and alert when v0.8.1 or earlier is used to gate package installation.

How to Mitigate CVE-2026-84811

Immediate Actions Required

Stop treating agentverus-scanner v0.8.1 verdicts as authoritative for packages containing __pycache__ directories.
Strip __pycache__ directories from packages before scanning and before installation in production environments.
Add a pre-scan step that fails any package shipping .pyc files alongside source, forcing regeneration from trusted sources.

Patch Information

No fixed version is listed in the enriched CVE data. Monitor the upstream project for a release addressing the excluded file types. Track GitHub Issue #27 and the GitHub AgentVerus Scanner repository for advisories and patched releases.

Workarounds

Preprocess packages with find <pkg> -type d -name __pycache__ -exec rm -rf {} + before submitting them to the scanner.
Set the PYTHONDONTWRITEBYTECODE=1 environment variable in build pipelines to prevent accidental inclusion of bytecode artifacts.
Run Python with -B to suppress bytecode file usage during package validation testing.
Enforce a policy that only source distributions (sdist) without prebuilt .pyc files are eligible for CERTIFIED verdicts.

bash

# Configuration example: strip bytecode before scanning
find ./package -type d -name __pycache__ -exec rm -rf {} +
find ./package -type f -name '*.pyc' -delete
export PYTHONDONTWRITEBYTECODE=1
agentverus-scanner scan ./package