CVE-2026-71963: Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hermes Agentto a version that resolves this vulnerability.Fixed in 0.21.0Patch commit f6234d0 - Operational
Assume provider API keys and full environment variables may have been exposed due to the RCE; rotate any configured provider API keys potentially accessible to Hermes Agent before/after upgrading to a version fixed by commit f6234d0.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Hermes Agent versions 0.18.2 through 0.21.0 are exposed if they open an attacker-controlled repository. The command runs in the user's process context, so the impact includes access to that user's environment and configured provider API keys.
What must an attacker do to trigger exploitation?
The attacker must supply a repository whose .git/config sets core.fsmonitor to an attacker-controlled command. After the user opens that repository, sending any message causes the agent to refresh the Git status index and execute the command.
Does exploitation require authentication or elevated privileges?
No authentication or privileges are required according to the supplied CVSS vector. However, exploitation requires user interaction: the user must open the malicious repository and send a message.
What is the available remediation?
Update to a version containing commit f6234d0, which fixes the issue. If updating is not immediately possible, avoid opening untrusted repositories with affected Hermes Agent versions.