PT-2026-48121 · Nesquena · Hermes-Webui

Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-49959

Mitre

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in api/workspace git.py through vectors such as core.fsmonitor during git status, protocol.ext.allow with ext:: remotes during git fetch, credential.helper, core.askPass, core.gitProxy, or inherited environment variables including GIT SSH COMMAND to achieve arbitrary command execution on the host running the application.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-49959

Affected Products

Hermes-Webui

References · 5

• https://github.com/nesquena/hermes-webui/commit/938ac9f55b53def1eefb48c4c42dabaf9c22e99c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49959 · Security Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.311 · Note
• https://github.com/nesquena/hermes-webui/pull/3776 · Note
• https://vulncheck.com/advisories/hermes-webui-rce-via-git-configuration-injection · Note