agentverus-scanner CVE-2026-101079

Exploitation requires local access (AV:L) with existing low privileges (PR:L) and passive user interaction (UI:P), and the attacker must be able to get crafted input processed by the agentverus-scanner's context analysis path so that the isSecurityDefenseSkill function in dist/scanner/analyzers/context.js evaluates it. The concrete prerequisite is control over the untrusted input that feeds the scanner's security-defense-skill classification decision. Limiting factors: no remote/network vector, an authenticated local foothold is needed, impact is confined to weakening the scanner's own detection (low integrity) with no data disclosure or service impact, and the affected product is a niche tool - so realistic risk is minimal even though public exploit material exists.

This is a genuinely low-priority issue and the low CVSS 4.0 score (2.4) is well-justified rather than deflated. The vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) shows a purely local vulnerability requiring existing low-privilege access and passive user interaction, with impact limited to a low integrity effect and no confidentiality or availability impact. Public exploit code exists (referenced as GitHub issue #28), which raises attacker convenience, but POC availability is a distinct signal from active exploitation - there is no CISA KEV listing and no EPSS score provided, so there is no evidence of real-world or automated exploitation. The signals are internally consistent: a local-only, integrity-only weakness in a niche developer tool. The CWE (CWE-807, reliance on untrusted inputs in a security decision) matches the described flaw - the scanner's own defense-classification logic can be fooled - meaning the practical consequence is a scanner that under-reports, not a direct system compromise. Net: low real-world risk despite the public POC.

An attacker who can supply input to the agentverus-scanner analysis pipeline (e.g., a crafted agent skill/context the scanner ingests) manipulates data so the isSecurityDefenseSkill function misclassifies malicious content as a legitimate security-defense skill, causing the scanner to skip or downgrade its detection. Public exploit material exists via the project's GitHub issue #28. Because the CVSS vector is local (AV:L) with low privileges and passive user interaction, the attacker needs a foothold or to get their input processed locally rather than exploiting over the network.