CVE-2026-84809

Hardcoded skip of __pycache__ and .pyc/.pyo/.pyd lets malicious bytecode bypass scans.

• CVSS 7.1
• 693
• Input Validation and Sanitization
• Remote

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.

CVE

CVE-2026-84809

CWE

693

CVSS base score

7.1

Published

2026-09-02

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Python

Solution

Upgrade Tencent AI‑Infra‑Guard to version 3.7.2, which removes the hard‑coded __pycache__ and .pyc/.pyo/.pyd exclusions from the skill‑scan component.

import os
import importlib.util

def load_skill_modules(skill_dir):
    """
    Load all Python modules in the given directory as skill plugins.
    """
    modules = {}
    for entry in os.scandir(skill_dir):
        if not entry.is_file():
            continue
        # VULNERABLE: skips compiled bytecode files, allowing malicious .pyc to be imported later
        if entry.name.startswith('__pycache__') or entry.name.endswith(('.pyc', '.pyo', '.pyd')):
            continue
        if entry.name.endswith('.py'):
            spec = importlib.util.spec_from_file_location(entry.name[:-3], entry.path)
            mod = importlib.util.module_from_spec(spec)
            spec.loader.exec_module(mod)
            modules[entry.name] = mod
    return modules

import os
import importlib.util

def load_skill_modules(skill_dir):
    """
    Load all Python modules in the given directory as skill plugins.
    """
    modules = {}
    for entry in os.scandir(skill_dir):
        if not entry.is_file():
            continue
        # FIX: restrict loading to source files only, preventing execution of compiled bytecode
        if not entry.name.endswith('.py'):
            continue
        spec = importlib.util.spec_from_file_location(entry.name[:-3], entry.path)
        mod = importlib.util.module_from_spec(spec)
        spec.loader.exec_module(mod)
        modules[entry.name] = mod
    return modules

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202684809,
  title        = {{Hardcoded skip of __pycache__ and .pyc/.pyo/.pyd lets malicious bytecode bypass scans.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-84809},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-84809/}}
}