TI-2026-36802 Aliases CVE-2026-49959 GHSA-69x8-4j5h-mmr4

Hermes WebUI < 0.51.311 RCE via Git Configuration Injection

MEDIUM 41CWE-78Published 2026-06-09 · Updated 2026-07-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in api/workspace_git.py through vectors such as core.fsmonitor during git status, protocol.ext.allow with ext:: remotes during git fetch, credential.helper, core.askPass, core.gitProxy, or inherited environment variables including GIT_SSH_COMMAND to achieve arbitrary command execution on the host running the application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00945 61st percentileScored 2026-11-07

Fix Fixed hermes-webui (nesquena): 0.51.311

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nesquena	hermes-webui	before 0.51.311	0.51.311	Patch available	CNA

hermes-webui Vendornesquena Affected before 0.51.311 Fixed in 0.51.311 Patch available CNA

Remediation

Fix · CNA hermes-webui (nesquena) Fixed in 0.51.311

Timeline

2026-10-02 Threatist record created from CVE-2026-49959
2026-10-03 Alias added: GHSA-69x8-4j5h-mmr4

References

Patch 1

https://github.com/nesquena/hermes-webui/commit/938ac9f55b53def1eefb48c4c42dabaf9c22e99c

Other 2

TI-2026-36807 Hermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settings CVSS 4.0CRITICAL 9.2
TI-2026-39885 Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow Endpoint CVSS 4.0MEDIUM 6.9
TI-2026-39878 Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltration via Session Export Endpoint CVSS 4.0HIGH 7.1
TI-2026-39877 Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint CVSS 4.0HIGH 7.1
TI-2026-36799 Hermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search CVSS 4.0HIGH 7.1
TI-2026-09773 Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass CVSS 4.0HIGH 7.1

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences