CVE-2026-120202

6.5 MEDIUMpublic exploit available

Published 2026-10-31 · Updated 2026-10-31

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a skill bundle with an unchecked-hash .pyc under scripts/<subdir>/__pycache__/ that ramparts silently ignores, while CPython executes it when the skill runs.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weaknesses

CWE-693

Public exploit & PoC references

https://github.com/highflame-ai/ramparts
https://github.com/highflame-ai/ramparts/blob/v0.8.10/src/skills.rs#L898
https://github.com/highflame-ai/ramparts/issues/154

All references

https://github.com/highflame-ai/ramparts
https://github.com/highflame-ai/ramparts/blob/v0.8.10/src/skills.rs#L898
https://github.com/highflame-ai/ramparts/issues/154
https://www.vulncheck.com/advisories/highflame-ramparts-0.8.1-through-0.8.10-skill-bundle-scan-bypass-via-nested-pyc

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

LOWCVE-2025-71424PoC
HIGHCVE-2026-100676PoC
CRITICALCVE-2026-100760
CRITICALCVE-2026-100775
HIGHCVE-2026-100808
CRITICALCVE-2026-100828
CRITICALCVE-2026-100829
UNSCOREDCVE-2026-101899PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.