Log in Start free

Vulnerability · Published Sep 28, 2026 · Assigned by VulDB

CVE-2026-101079agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision

Low 2.8

In plain English

A low-severity improper input validation in agentverus-scanner from agentverus. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)2.8Low
Exploit odds (30 days)0.1%top 98.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/scanner/analyzers/context.js. Performing a manipulation results in reliance on untrusted inputs in a security decision. The attack must be initiated from a local position. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

VendorProductVersions
agentverus agentverus-scanner 0.8.00.8.1

Weakness: CWE-807, CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

References