The vulnerability arises when hermes subcommands accept arbitrary options under the -O flag and log them verbatim. If a user supplies sensitive data such as API tokens via this option, that data is written to the standard log file in clear text. Attackers who can read the log therefore obtain credentials that could compromise downstream services. The CWE associated with this issue is Log File Data Leak (CWE‑532).

Affected vendor: softwarepub, product: hermes. Versions from 0.8.1 up to before 0.9.1 are vulnerable. The fix was implemented in release 0.9.1. The vulnerability affects all installations that use the command‑line interface and write logs to disk. No specific operating system or platform exclusions are noted.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% suggests the probability of exploitation in the wild is very low. Because the flaw is discovered via local accessibility to log files, the attack vector is most likely local or remote if an attacker already gains file read access; it is not a remote code execution vector. The vulnerability is not yet listed in the CISA KEV catalog, so no active exploit is documented. Nevertheless, any compromise of log files by a malicious user could expose credentials and jeopardize authentication to external services.