hermes's raw options logging may disclose secrets passed in via subcommand options argument
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens (e.g., via hermes deposit -O invenio_rdm.auth_token SECRET), these are written to the log file in plain text, making them available to whoever can access the log file. This vulnerability is fixed in 0.9.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| softwarepub | hermes | 0.8.1 to before 0.9.1 | 0.9.1 | Patch available | CNA |
| — | hermes (PyPI) | 0.8.1 to before 0.9.1 | 0.9.1 | Patch available | GHSA-jm5j-jfrm-hm23 |
- hermes Vendorsoftwarepub Affected 0.8.1 to before 0.9.1 Fixed in 0.9.1 Patch available CNA
- hermes (PyPI) Vendor— Affected 0.8.1 to before 0.9.1 Fixed in 0.9.1 Patch available GHSA-jm5j-jfrm-hm23
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:software-metadata.pub:hermes:*:*:*:*:*:python:*:* | 0.8.1 to before 0.9.1 | Vulnerable | Software-metadata.pub |
- cpe:2.3:a:software-metadata.pub:hermes:*:*:*:*:*:python:*:* Versions 0.8.1 to before 0.9.1 Vulnerable ·Software-metadata.pub
Remediation
- Fix · CNA hermes (softwarepub) Fixed in 0.9.1
- Fix · GHSA-jm5j-jfrm-hm23 hermes (PyPI) Fixed in 0.9.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-22798
- 2026-10-03 Alias added: GHSA-jm5j-jfrm-hm23
References
Patch 3
Sources
- CVE-2026-22798 · CVE Program
- CVE-2026-22798 · NVD
- FIRST EPSS
- GHSA-jm5j-jfrm-hm23 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences