agentverus-scanner EUVD-2026-70226

Exploitation requires that the victim organization uses agentverus-scanner as a gate for approving Python packages and that the attacker can introduce a package into a registry or path the scanner evaluates. The malicious package must include at least one __pycache__ directory with a valid .pyc file whose bytecode diverges from the accompanying .py source. CPython must be present in the execution environment (any CPython 3.x version that validates the .pyc header). No authentication or elevated privilege is required to craft or distribute the malicious package. Exploitation is limited to environments that (a) run agentverus-scanner v0.8.1 or an unpatched version, (b) treat its CERTIFIED verdict as sufficient approval for package import, and (c) subsequently import the approved package in a live Python runtime.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N) captures only the scanner's own system impact - a false-positive CERTIFIED verdict - and omits subsequent system RCE, which is the actual realized harm. Real-world risk is materially higher: an attacker with no privileges can publish a poisoned package to any Python registry, pass scanner gate checks, and achieve arbitrary code execution in every environment that trusts the scanner's verdict. The attack is low-complexity and requires only passive user interaction (a normal import). No KEV listing and no confirmed public exploit code mitigate urgency, but the bypass technique is fully described in the VulnCheck advisory. EPSS data is absent from available signals. The primary risk limiter is the scanner's niche deployment footprint; organizations that have integrated agentverus-scanner into CI/CD or supply-chain vetting pipelines face meaningful supply-chain RCE exposure.

An attacker publishes a PyPI package containing a harmless math_utils.py alongside a __pycache__/math_utils.cpython-312.pyc that, when imported, beacons out and opens a reverse shell. A victim organization's CI/CD pipeline scans the package with agentverus-scanner, receives a CERTIFIED verdict with high trust scores, approves the dependency, and deploys it - triggering code execution at the first import in staging or production.