Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Hermes Agent 0.18.2‑0.21.0 lets attacker run commands

CVE-2026-71963 · published 2 months ago
Summary

The Hermes Agent versions from 0.18.2 through 0.21.0 can be tricked by a specially crafted code folder (a repository). When a user opens that folder and sends a message, the agent runs a command that the attacker placed inside, giving the attacker the ability to execute any program on the user’s computer and view sensitive data such as API keys. Update the agent to the latest version that includes the fix, or avoid opening untrusted code folders.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
nousresearch hermes-agent <= 0.21.0
Original advisory text
Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published3 Sep 2026
Updated3 Nov 2026
First seen3 Sep 2026
Sources
CVE-2026-71963 · NVD
CVE-2026-71963 · MITRE
CVE-2026-71963 · OSV
Track software like this
Free during beta