CVE-2026-3854

GitHubCurated repository PoCScannerC++SecureWithUmer/CVE-2026-PoCs

PoC files

23 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that prints 'GHES CVE Scanner' and a status message, functioning as a placeholder scanner entry point with no vulnerability detection or exploitation logic.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a single Python file (scanner.py) that prints two static strings. No network activity, file operations, command execution, obfuscation, or any other behavior is present. The code does not exhibit backdoor, deceptive, or harmful functionality.

ClassificationScanner
Model confidence90%
AuthenticationUnknown
Languagespython
Target softwareGitHub Enterprise Server
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script is named 'scanner.py', prints 'GHES CVE Scanner', and contains only a main function that outputs initialization messages. It does not contain any code to exploit or detect a vulnerability, making it a scanner stub.

isagoakira-ghes-cve-scanner-a4fba0a/scanner.py:1-9

Observed behavior

  • Prints 'GHES CVE Scanner' and 'G0: 项目初始化完成' to stdout.isagoakira-ghes-cve-scanner-a4fba0a/scanner.py:5-6
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Static Print
print("GHES CVE Scanner")The script prints a static banner string.isagoakira-ghes-cve-scanner-a4fba0a/scanner.py:5
Static Print
print("G0: 项目初始化完成")The script prints a static initialization message.isagoakira-ghes-cve-scanner-a4fba0a/scanner.py:6
Review boundaries

What the analysis did not establish

  • Only one file (scanner.py) is included in the evidence; 22 other files in the artifact are unclassified and not analyzed.
  • The evidence coverage is incomplete for the artifact as a whole, so the classification is based solely on the provided scanner.py file.
  • Only one text file (scanner.py) was selected for review; 22 unclassified files totaling 88,820 bytes were not analyzed and are not included in the evidence packet. Their content is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

3