CVE-2026-120202 in ramparts
Summary
by MITRE • 10/31/2026
Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a skill bundle with an unchecked-hash .pyc under scripts/<subdir>/__pycache__/ that ramparts silently ignores, while CPython executes it when the skill runs.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in Highflame Ramparts versions 0.8.1 through 0.8.10 represents a critical security scan bypass mechanism rooted in flawed directory traversal and file inclusion logic within the bundle processing subsystem. The core technical flaw lies in the implementation of two specific functions, collect_bundle_siblings and walk_bundle_subdir, which are responsible for aggregating files from distributed skill bundles prior to execution or analysis. These functions exhibit an incomplete enumeration behavior by failing to recursively traverse nested subdirectories and explicitly ignoring Python compiled bytecode files with the .pyc extension during their scanning phase. This oversight creates a significant discrepancy between what the security scanner perceives as present in the bundle and what is actually available for runtime execution, thereby establishing a blind spot that can be exploited by malicious actors.
From an operational perspective, this architectural weakness allows attackers to embed hidden malicious payloads within skill bundles distributed through the Ramparts ecosystem. By placing unchecked .pyc files inside nested directories such as scripts/<subdir>/_pycache_, adversaries ensure that these files are completely invisible to the static analysis and integrity verification processes performed by the platform's security scanners. The scanner, relying on the incomplete file list generated by the vulnerable functions, concludes that the bundle is clean because it never inspects the hidden bytecode files. However, when a user or automated system executes the skill, the underlying Python interpreter naturally resolves these .pyc files as part of its standard import mechanism, leading to the silent execution of arbitrary code without any security warnings or integrity checks.
This vulnerability aligns with CWE-829, which describes Inclusion of Functionality from Untrusted Control Sphere, and specifically relates to CWE-754, Improper Check for Unusual or Exceptional Conditions, as the system fails to validate all potential execution paths within a bundle structure. Furthermore, this technique is indicative of ATT&CK T1027, Obfuscated Files or Information, where attackers use indirect methods to hide malicious content from detection systems. The ability to bypass integrity checks by exploiting file format exceptions and directory depth limitations undermines the fundamental trust model of the skill distribution system, potentially leading to remote code execution, data exfiltration, or lateral movement within environments that rely on these skills for automation tasks.
To mitigate this risk, immediate remediation is required in the form of a software update that patches the collect_bundle_siblings and walk_bundle_subdir functions. The fix must ensure recursive traversal of all nested directories regardless of depth and enforce strict inclusion policies for .pyc files during the scanning phase. Security scanners should be configured to treat compiled bytecode with the same scrutiny as source code, verifying hashes and signatures before allowing execution. Additionally, organizations currently running affected versions should audit their deployed skill bundles for any unexpected _pycache_ directories or unauthorized .pyc files that were not part of the original verified package manifest. Implementing a whitelist approach for allowed file types during bundle ingestion can further reduce the attack surface by preventing the inclusion of non-standard executable artifacts until they are explicitly validated and approved by security teams.