AI-Infra-Guard CVE-2026-84809

The operator must use a vulnerable version of AI-Infra-Guard (through v4.6.0) with the skill-scan component to evaluate a skill package, then install that package on a system running CPython. The attacker must be able to deliver a crafted skill package to the operator - via a public or private skill marketplace, a supply-chain compromise of a legitimate skill repository, or social engineering. No special server-side configuration is required; the bypass is present in the default scanner behavior. Exploitation is limited by the requirement for one user interaction (UI:P): the operator must choose to install the skill after receiving the false SAFE verdict. Automated CI/CD pipelines that install skills without human review of scan output would reduce this barrier. Exploitation does not require any credentials, network privileges, or non-default settings on the target host.

The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:N/UI:P captures the attack well: the malicious skill can be distributed over any network channel (marketplace, email, repository), requires no special attack conditions or attacker privileges, but does require the operator to perform the installation step (UI:P). The impact is scoped to VI:H on the vulnerable system with no confidentiality or availability impact per the upstream assessment, though code execution at import time could realistically extend to C:H/A:H in practice - this discrepancy should be verified with Tencent. No CISA KEV listing and no public exploit code identified, limiting immediate widespread risk. The realistic threat actor is one who can publish a skill to a marketplace or deliver a skill package socially; the attack is deterministic and requires no vulnerability in CPython itself. Risk is meaningful for organizations actively vetting third-party skills through AI-Infra-Guard before the patch, particularly in automated pipelines where operator review of scanner output may be cursory.

An attacker publishes a skill package to a shared skill marketplace containing a clean, human-readable scanner_tool.py alongside a __pycache__/scanner_tool.cpython-311.pyc file containing a reverse-shell payload compiled for the target Python version. An operator runs AI-Infra-Guard skill-scan, which traverses the package and silently skips both the __pycache__ directory and all .pyc files, reporting a SAFE verdict. Upon installation, CPython imports the package, finds the cached .pyc bytecode, and executes the attacker's payload - no Python source match required.