Agentverus Scanner
Monthly
Untrusted input routed into agentverus-scanner's security-defense-skill analyzer can override the classification decision made by isSecurityDefenseSkill in dist/scanner/analyzers/context.js, allowing an attacker to weaken or falsify the scanner's own detection results for versions up to 0.8.1. Exploitation requires an authenticated local foothold and passive user interaction, and the impact is limited to low integrity loss with no confidentiality or availability effect; the CVSS 4.0 score of 2.4 reflects that narrow scope and is appropriately calibrated rather than deflated. Publicly available exploit code exists, and the project was notified via an issue report but has not responded, so no vendor-released patch has been identified at time of analysis.
Untrusted input routed into agentverus-scanner's security-defense-skill analyzer can override the classification decision made by isSecurityDefenseSkill in dist/scanner/analyzers/context.js, allowing an attacker to weaken or falsify the scanner's own detection results for versions up to 0.8.1. Exploitation requires an authenticated local foothold and passive user interaction, and the impact is limited to low integrity loss with no confidentiality or availability effect; the CVSS 4.0 score of 2.4 reflects that narrow scope and is appropriately calibrated rather than deflated. Publicly available exploit code exists, and the project was notified via an issue report but has not responded, so no vendor-released patch has been identified at time of analysis.