Is CVE-2026-84809 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84809?

CVE-2026-84809 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-84809

Description

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.