CVE-2026-49958: Hermes WebUI TOCTOU Race Condition Arbitrary File Deletion

Technical summary

The vulnerability exists in the git_discard function within api/workspace_git.py. The flaw is a classic time-of-check time-of-use (TOCTOU) race condition: the code validates a file path using safe_resolve_ws() to ensure it remains within the configured workspace boundary, but an attacker can replace a path component with a symlink between this validation step and the actual deletion call (Path.unlink() or shutil.rmtree()). Because symbolic link resolution occurs at deletion time rather than validation time, the delete operation follows the symlink to an arbitrary location outside the workspace. This is a well-known class of vulnerability in file operations where validation and use are separated in time.

Business impact

Successful exploitation allows deletion of arbitrary files accessible to the Hermes WebUI process. If the process runs with elevated privileges or has broad file system access, an attacker could remove critical application files, configuration files, or user data, leading to denial of service, data loss, or system instability. Organizations using Hermes WebUI for collaborative development or workspace management face risk of disruption and potential recovery costs. The local attack vector and requirement for user interaction limit blast radius, but the integrity impact is serious.

Affected systems

Hermes WebUI versions before 0.51.303 are vulnerable. Organizations running this application should verify their installed version immediately. The vulnerability requires local system access and valid user credentials, so it is not exploitable via remote network attack. Shared development environments, CI/CD systems, or multi-tenant deployments running Hermes WebUI face elevated risk.

Exploitability

Exploitation requires local system access, valid user credentials, and the ability to interact with the Hermes WebUI interface to trigger the git_discard function. An attacker must also achieve precise timing to insert a symlink between validation and deletion—this is technically feasible but not trivial. The CVSS score of 5 (Medium) reflects the high bar for exploitation: local access requirement, high attack complexity, and user interaction needed. However, once conditions align, the attack is deterministic and difficult to detect in real time.

Remediation

Upgrade Hermes WebUI to version 0.51.303 or later. This version addresses the race condition by ensuring path validation and deletion occur atomically or by rechecking the resolved path immediately before deletion. Organizations unable to upgrade immediately should restrict local system access to trusted users only and monitor file system activity for unexpected deletion patterns. Review access controls for the Hermes WebUI process itself to minimize the scope of files it can reach.

Patch guidance

Apply the upgrade to Hermes WebUI version 0.51.303 or later as soon as feasible. Verify the patched version is installed in all environments where Hermes WebUI is deployed, including development machines, build servers, and shared systems. Test the patched version in a staging environment to confirm compatibility with your workflows before rolling out to production. Check vendor release notes to confirm that version 0.51.303 or later addresses CVE-2026-49958 specifically.

Detection guidance

Monitor file system access logs for unexpected symlink creation or unusual deletion patterns, particularly in directories outside the expected workspace boundary. Track process behavior from the Hermes WebUI application: look for sequences where a directory is validated, then rapidly replaced with a symlink, followed by a delete operation. Endpoint detection and response (EDR) tools can alert on suspicious symlink-to-delete chains. Audit logs from Hermes WebUI itself should be reviewed for git_discard function calls, especially any that fail or show unexpected path resolution. Intrusion detection signatures for TOCTOU attacks in file operations may also apply.

Why prioritize this

While this vulnerability carries a Medium CVSS score, it deserves prompt attention in environments where Hermes WebUI is widely deployed or where the process runs with elevated privileges. The race condition is exploitable by any local user with credentials, and successful exploitation results in arbitrary file deletion—a significant integrity and availability impact. Organizations should prioritize patching if Hermes WebUI manages critical workspaces or is deployed on systems with sensitive data. However, the local attack vector and user interaction requirement mean this is not an emergency-level priority for air-gapped or tightly controlled environments.

Risk score, explained

CVSS 3.1 score of 5.0 (Medium) reflects: local attack vector (AV:L), high attack complexity due to race condition timing (AC:H), low privileges required but user interaction required (PR:L/UI:R), no confidentiality impact (C:N), low integrity impact limited to files the process can reach (I:L), and high availability impact from potential data deletion (A:H). The score correctly penalizes the attack complexity and privilege requirements while recognizing the serious availability consequences.

Frequently asked questions