Vulnerability Description
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Tencent/AI-Infra-Guard
- https://github.com/Tencent/AI-Infra-Guard/blob/v4.6.0/skill-scan/skill_scan/tool
- https://github.com/Tencent/AI-Infra-Guard/blob/v4.6.0/skill-scan/skill_scan/util
- https://github.com/Tencent/AI-Infra-Guard/commit/7e0f749e3c023e5c6ab7b32fe97b3f6
- https://github.com/Tencent/AI-Infra-Guard/issues/531
- https://www.vulncheck.com/advisories/tencent-ai-infra-guard-skill-scan-analysis-
- https://github.com/Tencent/AI-Infra-Guard/issues/531
FAQ
What is CVE-2026-84809?
CVE-2026-84809 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple ...
How severe is CVE-2026-84809?
CVE-2026-84809 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-84809?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.