agentverus‑scanner fails to analyze compiled Python bytecode files located in companion code directories, permitting an attacker to ship malicious __pycache__ entries together with benign source. When the scanner processes the codebase it simply imports the bytecode and executes it, resulting in arbitrary Python code running inside the scanner. The vulnerability therefore undermines the confidence of the scanner’s CERTIFIED verdict and the high trust scores it assigns in both static and semantic modes.

The product vendor is agentverus, with the scanner component agentverus‑scanner. Versions at the time of this advisory are unspecified; the issue was found in source code present in the 0.8.1 release series. All installations of agentverus‑scanner that include the companion code analysis feature are therefore potentially affected until a change is made.

The nominal CVSS score of 7.1 reflects a moderate to high severity for code execution in the scanner. EPSS is not available, and the vulnerability is not yet listed in CISA’s KEV catalog, implying no current public exploitation reports. Exploitation requires the attacker to control the contents of a repository being scanned or to supply a malicious archive that contains a __pycache__ directory; the scanner then imports the bytecode during analysis, executing arbitrary Python. Attackers could thereby hijack the scanner environment, potentially affecting other users if the scanner runs in a shared context. Because the bypass occurs locally during scan time, the risk is highest for developers or CI systems that trust the scanner’s verdicts.