Tencent AI-Infra-Guard EUVD-2026-88341

Exploitation is limited to the local host (AV:L): the attacker must be able to supply or influence file/directory path arguments passed into AI-Infra-Guard's skill-scan or mcp-scan file tools (the dir_tree, write_file, and grep actions), and requires low-level privileges plus passive user interaction (UI:P) - i.e. an operator running a scan over attacker-controlled paths or content. The specific defect is that the directory-containment guard used a prefix check (abs_path.startswith(folder)) instead of a canonical-path check, so exploitation depends on the scanner processing a path that either escapes via traversal or shares a string prefix with the allowed folder (e.g. a sibling directory). It is NOT remotely reachable, NOT unauthenticated, and does not affect a default network-exposed service; the local vector, required privileges, and required user interaction are the principal limiting factors.

This is a genuinely low-risk issue and the raw numbers agree with that reading. The CVSS 4.0 vector (AV:L/AC:L/PR:L/UI:P/VC:L/VI:L/VA:L) scores just 0.9, reflecting local-only attack vector, required privileges, required user interaction (passive), and only Low technical impact across confidentiality, integrity, and availability with no scope change. EPSS and KEV are both absent, and while a public exploit reference exists (the GitHub issue #538), that indicates 'publicly available exploit code exists' - NOT active exploitation. There is no conflicting signal here: every source points the same direction (low real-world urgency). The one nuance worth stating is that VulDB-originated CVEs of this kind are often researcher-driven proof-of-concepts against emerging open-source projects rather than attacker-prioritized targets, and the source diff confirms this is a prefix-matching flaw (os.path.startswith used instead of os.path.commonpath) inside a security-scanning tool's own working-directory guard - a bounded, local-context weakness rather than a remotely reachable server flaw. This is a low priority to patch on normal cadence, not an emergency.

An attacker who can influence the file or directory paths fed to AI-Infra-Guard's skill/MCP scanning tools supplies a path that shares a prefix with the intended scan folder (e.g. a sibling path like '/scan-folder-evil') or otherwise escapes it, because the guard only checks abs_path.startswith(folder). Because exploitation is local and requires user interaction (the operator running a scan on attacker-supplied content), the scanner then lists, reads, or writes files outside its intended sandbox directory. A public proof-of-concept is referenced in the vendor's own GitHub issue tracker (#538).