CVE-2026-120202 — Vulnerability intelligence
highflame-ai — ramparts
Published:
- CVSS
- 7.1
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a skill bundle with an unchecked-hash .pyc under scripts/<subdir>/__pycache__/ that ramparts silently ignores, while CPython executes it when the skill runs.