{"id":"CVE-2026-120202","kind":"vulnerability","aliases":["CVE-2026-120202"],"related":[],"title":"Highflame ramparts: security scanner skips nested .pyc files, hiding malicious skill code","description":"Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a skill bundle with an unchecked-hash .pyc under scripts/<subdir>/__pycache__/ that ramparts silently ignores, while CPython executes it when the skill runs.","summary":"Highflame ramparts 0.8.1 to 0.8.10 does not look at nested directories or .pyc files when scanning an agentskills.io skill bundle (collect_bundle_siblings and walk_bundle_subdir in src/skills.rs). A skill with clean .py decoys and a malicious unchecked-hash .pyc under scripts/<subdir>/__pycache__/ scans with 0 findings, but CPython loads the .pyc when the skill's code is imported. The reporter's PoC ran os.system at import time on 0.8.2. No fixed release or vendor response found; issue #154 is open.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ramparts","fixed":[],"affected":">= 0.8.1, <= 0.8.10","ecosystem":"crates.io"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","cargo","highflame","mcp","python","ramparts","rust","scanner-bypass","skills"],"not_affected_if":["no-third-party-skills","ramparts-not-in-range","skills-not-scanned-with-ramparts"],"how_to_check":"- ramparts is a Rust crate, not a pip package: run `ramparts --version` or `cargo install --list` and look for 0.8.1 through 0.8.10 (0.8.10 is the latest on crates.io).\n- Before trusting a ramparts scan of a skill bundle, run `find <bundle> -name '*.pyc' -o -name __pycache__` and treat any hit as suspect; delete them or reject the bundle.","fix":"No fixed version known. Latest crates.io release is 0.8.10, which is affected. Until a fix ships, remove all __pycache__ directories and .pyc files from skill bundles before installing, and do not rely on ramparts alone to vet untrusted skills.","status":"open","published_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","triaged_at":"2026-10-31T18:40:35+00:00","updated_at":"2026-10-31T18:42:14+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-31T18:40:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Highflame ramparts: security scanner skips nested .pyc files, hiding malicious skill code","impact":"high","summary":"Highflame ramparts versions 0.8.1 through 0.8.10 skip nested directories and .pyc files when scanning skill bundles. An attacker can ship a malicious unchecked-hash .pyc inside a skill bundle that the scanner ignores but CPython executes when the skill runs.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["ramparts","python","ai-agents","skills"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"malicious bytecode runs when a skill executes, bypassing the scanner","analyst_note":"Confirm the fixed version and whether the NVD entry's CVSS 7.1 matches the described attack path; no fix version is stated in the sources.","how_to_check":"- Check the installed ramparts version, for example with `pip show ramparts` or the package lockfile, and look for versions `0.8.1` through `0.8.10`.\n- Review any skill bundles you install for `__pycache__` directories containing `.pyc` files under `scripts/`.","plain_action":"","needs_analyst":true,"not_affected_if":["ramparts-not-in-range","no-third-party-skills"],"who_is_affected":"Teams that run ramparts to scan AI agent skill bundles before use, in versions 0.8.1 through 0.8.10. Exposure depends on installing untrusted skill bundles that contain precompiled .pyc files, which the scanner does not inspect. Teams not running ramparts in that version range, or not loading third-party skill bundles, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4191,"output_tokens":641,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the NVD entry's CVSS 7.1 matches the described attack path; no fix version is stated in the sources.","search":"'-120202':15A,18A '-2026':14A,17A '/__pycache__':80B,165C '0':83B '0.8.1':38B,121C '0.8.10':40B,123C '0.8.2':107B '154':116B 'agent':22B 'agentskills.io':53B 'ai':21B,24B 'ai-ag':20B 'ai-tool':23B 'allow':131C 'attack':132C,151C 'bundl':55B,57B,61B,139C,143C,156C 'bypass':34B,128C 'cargo':26B 'clean':68B 'code':12A,94B 'collect':56B,138C 'contain':124C 'cpython':86B,171C 'cve':13A,16A 'decoy':70B 'directori':46B,147C 'distribut':153C 'execut':172C 'file':8A,49B,150C 'find':84B 'fix':109B 'found':114B 'hash':76B,161C 'hide':9A,134C 'highflam':1A,27B,36B,119C 'ignor':169C 'import':96B,104B 'issu':115B 'load':87B 'look':43B 'malici':10A,73B,135C 'mcp':28B 'nest':6A,45B,146C 'open':118B 'os.system':102B 'payload':136C 'poc':100B 'py':69B 'pyc':7A,48B,77B,89B,149C,162C 'python':29B 'rampart':2A,30B,37B,120C,167C 'ramparts':19A 'ran':101B 'releas':110B 'report':98B 'respons':113B 'run':177C 'rust':31B 'scan':51B,81B,127C 'scanner':4A,33B 'scanner-bypass':32B 'script':79B,164C 'secur':3A,126C 'sibl':58B,140C 'silent':168C 'skill':11A,35B,54B,66B,92B,155C,176C 'skip':5A,145C 'src/skills.rs':64B 'subdir':62B,144C 'time':105B 'tool':25B 'uncheck':75B,160C 'unchecked-hash':74B,159C 'vendor':112B 'vulner':129C 'walk':60B,142C","nicknames":[],"mitigations":[],"who_affected":"Teams that run ramparts to scan AI agent skill bundles before use, in versions 0.8.1 through 0.8.10. Exposure depends on installing untrusted skill bundles that contain precompiled .pyc files, which the scanner does not inspect. Teams not running ramparts in that version range, or not loading third-party skill bundles, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-31T18:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-120202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120202","severity":null,"published_at":"2026-10-31T18:17:08+00:00","modified_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","fetched_at":"2026-10-31T18:37:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120202:1257","url":null,"severity":null,"published_at":"2026-10-31T18:42:14+00:00","modified_at":"2026-10-31T18:42:14+00:00","first_seen_at":"2026-10-31T18:42:14+00:00","fetched_at":"2026-10-31T18:42:14+00:00","note":"VulnCheck CNA advisory + reporter's issue #154 (open, 0 comments, tested on 0.8.2) read; no fix or vendor response found, latest crates.io release is 0.8.10 (still affected). Triage's pip check is wrong: ramparts is a Rust crate (cargo install). CVSS 7.1 (v4, VI:H only, UI:P) understates arbitrary code execution at skill run, but the vector is VulnCheck's; severity left high. Nothing verified: sources are the CNA and a third-party reporter, not the vendor."}],"documents":[{"id":34323,"url":"https://www.vulncheck.com/advisories/highflame-ramparts-0.8.1-through-0.8.10-skill-bundle-scan-bypass-via-nested-pyc","title":"VulnCheck: Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":34325,"url":"https://github.com/highflame-ai/ramparts/issues/154","title":"ramparts #154: .pyc bytecode substitution bypass (open, no fix)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":34327,"url":"https://github.com/nedlir/skills-scanner-bypass","title":"nedlir/skills-scanner-bypass PoC","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":34329,"url":"https://crates.io/crates/ramparts/versions","title":"crates.io: ramparts versions (latest 0.8.10)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}