EUVD-2026-70224
GHSA-7vc4-66f2-3f5f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Skill distributed over network (AV:N), no attacker privileges needed (PR:N), operator must install (UI:R); impact scoped to integrity per upstream assessment, though RCE could extend C and A in practice.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.
Articles & Coverage 1
AnalysisAI
Tencent AI-Infra-Guard's skill-scan component allows scanner bypass via hardcoded exclusion of Python compiled bytecode, enabling malicious skill packages to pass a false SAFE verdict and execute arbitrary code on operator hosts. Attackers supply a skill with benign .py source decoys alongside malicious .pyc/.pyo/.pyd bytecode in __pycache__ directories; because three separate scanning surfaces in versions through v4.6.0 unconditionally skip these artifacts, the auditing LLM never sees the malicious payload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The operator must use a vulnerable version of AI-Infra-Guard (through v4.6.0) with the skill-scan component to evaluate a skill package, then install that package on a system running CPython. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:N/UI:P captures the attack well: the malicious skill can be distributed over any network channel (marketplace, email, repository), requires no special attack conditions or attacker privileges, but does require the operator to perform the installation step (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply upstream commit 7e0f749e3c023e5c6ab7b32fe97b3f6f2e8aeb04 from the AI-Infra-Guard repository, which removes `__pycache__` from all ignored-directory sets and compiled bytecode extensions from all ignored-extension sets across `agent.py`, `dir_actions.py`, and `pre_scan.py`, and adds explicit `[compiled-bytecode]` warnings surfaced to the LLM auditor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Tencent AI-Infra-Guard deployments and identify instances running version 4.6.0 or earlier; audit the list of installed skill packages for any from untrusted sources and inspect their __pycache__ directories for unexpected .pyc/.pyo/.pyd files. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-693 – Protection Mechanism Failure
View allShare
External POC / Exploit Code
Leaving vuln.today