CVE-2026-84809

Name of the Vulnerable Software and Affected Versions Tencent AI-Infra-Guard (affected versions not specified)

Description The skill-scan component fails to analyze compiled Python bytecode files because it hardcodes pycache directories and .pyc, .pyo, and .pyd extensions into skip lists. This allows an attacker to bundle malicious compiled bytecode with benign Python source files. Since the scanner ignores the bytecode, it may return a safe verdict, allowing the execution of arbitrary code when an operator installs the skill.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.