The vulnerability in agentverus agentverus-scanner up to version 0.8.1 is due to the isSecurityDefenseSkill function relying on untrusted inputs when making a security decision. This flaw can be manipulated by an attacker with local access and requires user interaction to exploit. The issue was reported early to the project, but no fix or official response has been provided. The CVSS 4.0 base score is 2.4, indicating low severity, with attack vector local, low complexity, and partial impact on integrity and availability.

An attacker with local access and limited privileges can manipulate inputs to influence a security decision within the agentverus-scanner, potentially bypassing intended security controls. The impact is limited to partial integrity and availability effects, and the overall severity is low. There are no known exploits in the wild beyond the public exploit code.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a patch is released, restrict local access to trusted users only and apply standard security best practices to limit exposure. Avoid executing untrusted code or inputs in the affected versions.