CVE-2026-49959: Hermes WebUI RCE via Git Config Injection

Technical summary

The vulnerability resides in api/workspace_git.py where Git subprocess invocations lack sufficient input validation or sandboxing of Git configuration parameters. An authenticated attacker can craft a malicious .git/config file in a workspace repository that exploits Git's extensible configuration system. Attack vectors include core.fsmonitor (executed during git status), protocol.ext.allow with ext:: remote URLs (during git fetch), credential.helper, core.askPass, core.gitProxy, or inherited environment variables like GIT_SSH_COMMAND. When the application invokes Git operations without neutralizing these configuration sources, arbitrary code execution on the host is possible. The vulnerability requires authentication but does not require user interaction on the target system.

Business impact

An authenticated attacker can achieve complete code execution on servers running Hermes WebUI, enabling data theft, malware deployment, lateral movement within the network, or service disruption. Since this requires valid credentials, the risk depends on your access control posture—if shared workspace accounts or weak authentication exists, the barrier to exploitation drops significantly. Organizations using Hermes WebUI for collaborative development face particularly high risk because workspace repositories are typically accessible to multiple team members, increasing the chance of either accidental or intentional exploitation.

Affected systems

Hermes WebUI versions before 0.51.311 are vulnerable. The exact scope of affected products is not specified in vendor advisories at this time; verify your deployed version against the official Hermes WebUI release notes and patch your infrastructure accordingly. Any instance where Hermes WebUI manages or executes Git operations on untrusted or semi-trusted repositories is at risk.

Exploitability

Exploitation requires valid authentication credentials, placing this in the 'authenticated attacker' category rather than fully unauthenticated. However, the attack is straightforward: an authenticated user simply commits a malicious .git/config file to a workspace repository, then triggers a Git operation (status, fetch, pull) through the WebUI. No complex bypass techniques are required once credentials are obtained. The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network accessibility, low attack complexity, and high impact across confidentiality, integrity, and availability. The vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of exploitation means monitoring for in-the-wild attacks is warranted.

Remediation

Upgrade Hermes WebUI to version 0.51.311 or later immediately. This is a mandatory update with no workarounds. Organizations unable to patch immediately should restrict access to Hermes WebUI to trusted users only, disable workspace git operations if feasible, and monitor for suspicious activity. Implement strong authentication (multi-factor authentication) and enforce principle of least privilege for workspace access.

Patch guidance

Apply the update to Hermes WebUI 0.51.311 or verify against the vendor advisory for any subsequent patch versions. After patching, validate that Git operations (status, fetch, pull) function normally within workspace repositories. Test with both public and private repositories to ensure the fix does not introduce regressions. Rolling updates are recommended to minimize downtime in production environments.

Detection guidance

Monitor Git subprocess execution logs and system calls for suspicious parameters in .git/config files, particularly entries involving core.fsmonitor, core.askPass, core.gitProxy, credential.helper, or protocol.ext settings. Look for GIT_SSH_COMMAND environment variable injection in process execution logs. Audit workspace repositories for recent commits that add or modify .git/config with non-standard settings. Network-level detection is limited since the vulnerability exploits legitimate Git operations; focus on behavioral analysis of child processes spawned by the Hermes WebUI application.

Why prioritize this

This vulnerability merits immediate prioritization because it enables unauthenticated-level impact (full RCE) despite requiring credentials, affects a collaboration platform likely integral to development workflows, and has straightforward exploitation mechanics. The absence from the KEV catalog does not indicate low risk—it reflects only that CISA has not yet received reports of active exploitation. Organizations should treat this as critical based on the CVSS 8.8 score and the high likelihood of exploitation attempts once the vulnerability becomes widely known.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: Attack Vector (Network), Attack Complexity (Low), Privileges Required (Low), User Interaction (None), and impact on Confidentiality, Integrity, and Availability (all High). This combination produces a HIGH severity rating. The primary mitigating factor is the requirement for valid authentication; however, in environments with shared accounts, weak passwords, or lateral movement post-compromise, this becomes a secondary concern. The real-world impact is likely to exceed the base score if supply-chain or insider-threat scenarios are considered.

Frequently asked questions