Description
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.
Published: 2026-09-03
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A malicious .git/config file can inject an arbitrary operating‑system command via the git core.fsmonitor configuration. When the Hermes Agent refreshes the git index (for example after a user sends a message), the injected command is executed within the agent’s process, giving the attacker full access to the environment, including provider API keys. This results in a complete compromise of confidentiality, integrity and availability for any system running the vulnerable agent.

Affected Systems

Hermes Agent versions 0.18.2 through 0.21.0 owned by the NousResearch:hermes-agent product are susceptible. No other product or vendor is listed as affected.

Risk and Exploitability

The CVSS score of 8.6 marks this as a high‑severity vulnerability. EPSS is currently unavailable, and the exploit is not listed in the CISA KEV catalog. An attacker can succeed by providing a crafted repository; the culprit must be able to open the repository or otherwise trigger a git status refresh. Once the configuration is injected, the agent will execute the command in the user’s context, exposing the environment and any stored credentials.

Generated by OpenCVE AI on September 3, 2026 at 16:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Hermes Agent to the patched version that incorporates commit f6234d0 or later.
  • If an update cannot be applied immediately, restrict the agent to operate only on trusted repositories and reject any .git/config that includes core.fsmonitor entries from external sources.
  • Configure Git to disable or remove the core.fsmonitor setting in all repositories before the agent processes them, preventing malicious command execution.

Generated by OpenCVE AI on September 3, 2026 at 16:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Nousresearch
Nousresearch hermes-agent
Vendors & Products Nousresearch
Nousresearch hermes-agent

Thu, 03 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.
Title Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Nousresearch Hermes-agent
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-03T15:41:27.998Z

Reserved: 2026-08-08T16:43:04.177Z

Link: CVE-2026-71963

cve-icon Vulnrichment

Updated: 2026-09-03T15:41:17.752Z

cve-icon NVD

Status : Received

Published: 2026-09-03T16:18:21.710

Modified: 2026-09-03T16:18:21.710

Link: CVE-2026-71963

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T16:30:05Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')