CVE-2026-84811: Protection Mechanism Failure in agentverus agentverus-scanner

The agentverus-scanner product fails to analyze compiled Python bytecode files located in companion code directories such as __pycache__. This failure allows attackers to ship malicious bytecode alongside benign source files, bypassing the scanner's security checks. As a result, the scanner incorrectly reports a CERTIFIED verdict with high trust scores in both static and semantic analysis modes, while arbitrary Python bytecode can be executed on import. The vulnerability affects versions >=0 and <=0.8.1 and has a CVSS 4.0 score of 7.1.

Attackers can bypass the security scanning process by including malicious compiled Python bytecode files in __pycache__ directories, leading to execution of arbitrary Python bytecode despite the scanner reporting a high-trust CERTIFIED verdict. This undermines the reliability of the scanner's security assessments and can facilitate undetected malicious code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about relying solely on agentverus-scanner's CERTIFIED verdicts and consider additional manual or alternative scanning methods to detect malicious bytecode in __pycache__ directories.