Tencent Ai Infra Guard vulnerabilities
3 vulnerabilities
Known vulnerabilities in Tencent Ai Infra Guard, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2026-101080tencent · ai-infra-guardTencent AI-Infra-Guard File Access dir_actions.py startsWith path traversalA vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. Upgrading to version 4.6.0 is able to mitigate this issue. The identifier of the patch is ac0384edc9dbea3b226edefcf50613bd8509134f. You should upgrade the affected component.CVSS4.8MediumEPSS0.14%RoutineCVE-2026-84809tencent · ai-infra-guard +1 moreTencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python BytecodeTencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.CVSS7.1HighEPSS0.57%RoutineCVE-2026-5585tencent · ai-infra-guardTencent AI-Infra-Guard Task Detail Endpoint task_manager.go information disclosureA vulnerability was found in Tencent AI-Infra-Guard 4.0. The affected element is an unknown function of the file common/websocket/task_manager.go of the component Task Detail Endpoint. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS7.5HighEPSS0.65%