CVE-2026-120202

Name of the Vulnerable Software and Affected Versions Highflame ramparts versions 0.8.1 through 0.8.10

Description A security scan bypass allows attackers to hide malicious payloads. This occurs because the functions collect bundle siblings() and walk bundle subdir() skip nested directories and .pyc files (compiled Python bytecode files). An attacker can distribute a skill bundle containing a .pyc file with an unchecked hash located under scripts/<subdir>/ pycache /, which the system ignores during scanning but CPython executes during runtime.

Recommendations Update Highflame ramparts to a version later than 0.8.10. As a temporary mitigation, restrict the distribution of skill bundles containing nested directories or pycache folders within the scripts/ directory.