CVE-2026-120202

The record

Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a skill bundle with an unchecked-hash .pyc under scripts/<subdir>/__pycache__/ that ramparts silently ignores, while CPython executes it when the skill runs.

Affected packages

Related vulnerabilities

• CVE-2026-93325 Buildx bake requires the user to grant entitlements with --allow or an interactive prompt… CWE-693
• CVE-2026-44267 Elo is a purely functional expression language for no-code tools. CWE-693
• CVE-2026-59031 In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of… CWE-693
• CVE-2026-58978 In multiple locations, there is a possible permission bypass due to a logic error in the… CWE-693
• CVE-2026-58979 In canPresent of PresentationController.java, there is a possible permission bypass due… CWE-693
• CVE-2026-58956 In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a… CWE-693
• CVE-2026-58946 In navigateUpTo of ActivityClientController.java, there is a possible permission bypass… CWE-693
• CVE-2026-58934 In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible… CWE-693