highflame-ai CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH highflame-ai CVE published 2026-10-31

CVE-2026-120202

Highflame ramparts versions 0.8.1 through 0.8.10 contain a security scan bypass vulnerability. This vulnerability allows attackers to hide malicious payloads by exploiting the skipping of nested directories and .pyc files in collect_bundle_siblings and walk_bundle_subdir. The vulnerability enables attackers to distribute malicious skill bundles with unchecked-hash .pyc files under scripts/<subdir>/__pycac [truncated]