Description

agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious __pycache__ entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports a CERTIFIED verdict with high trust scores in both static and semantic analysis modes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T17:18:05.447Z",
  "pubdate": "2026-09-02T17:18:05.447Z",
  "executiveSummary": "The agentverus-scanner is susceptible to a security bypass vulnerability involving the handling of compiled Python bytecode within __pycache__ directories. The vulnerability stems from the scanner's failure to perform integrity or semantic analysis on pre-compiled .pyc files present in companion directories. By including malicious bytecode entries, an attacker can execute arbitrary code upon application import while the scanner incorrectly generates a CERTIFIED verdict.\nThis flaw significantly undermines the efficacy of the security assessment process, as the tool provides false confidence through high trust scores in both static and semantic analysis modes. Attackers can effectively mask malicious payloads within legitimate-looking project structures, bypassing automated security gates. The impact is critical, as it allows for persistent code execution within environments where agentverus-scanner is relied upon to validate the integrity and safety of imported Python modules. Exploitation requires only the ability to place malicious bytecode within the target environment's file structure; once present, the Python interpreter will automatically load the compromised cache files if the corresponding source module is imported.",
  "technicalDetails": "The root cause of this vulnerability lies in the scanner's limited inspection scope, which prioritizes human-readable source code (.py files) while ignoring the contents of __pycache__ directories. Python's import mechanism naturally searches for pre-compiled bytecode files to optimize load times; if a .pyc file matches a source file and is newer, the interpreter executes the bytecode directly, bypassing any subsequent source-level security checks performed by the scanner.\nThe exploitation flow proceeds as follows: First, an attacker constructs a malicious Python payload encapsulated within a serialized bytecode object. This object is saved as a .pyc file corresponding to a legitimate or benign source file located in the application directory. Second, the attacker places this malicious .pyc file inside the appropriate __pycache__ sub-directory. Third, the agentverus-scanner initiates its scan. Because the scanner is configured to analyze source files exclusively, it performs static and semantic analysis on the benign source code while completely overlooking the presence of the malicious bytecode cached in the companion directory.\nConsequently, the scanner reports a CERTIFIED verdict and assigns a high trust score, as the benign source code does not exhibit anomalous behavior. Finally, upon application deployment or runtime initialization, the Python interpreter performs an import of the target module. Detecting the presence of the malicious .pyc file in __pycache__, the interpreter loads the arbitrary bytecode, leading to unauthorized code execution with the permissions of the host process. This bypass mechanism allows an attacker to achieve full code execution without ever modifying the audited source files, effectively rendering the scanner's integrity claims void. The vulnerability exposes the underlying system to supply chain attacks, where malicious logic is injected into pre-compiled artifacts that remain invisible to conventional source-code analysis tools."
}