CVE-2026-71963

Hermes Agent versions 0.18.2 through 0.21.0 contain an OS command injection flaw (CWE-78) in which the agent's git operations honor the core.fsmonitor setting in a repository's .git/config, letting that setting specify an attacker-controlled command. The attack is triggered when a user opens a crafted repository and sends any message, at which point the agent runs a git status index refresh that executes the injected command in the user's process context. A successful attacker gains arbitrary OS command execution with access to the user's full environment, including configured AI provider API keys, which can be exfiltrated. Anyone running an affected Hermes Agent version who opens untrusted or attacker-supplied repositories is exposed; the attack requires user interaction but no privileges or authentication on the target. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is currently known, and EPSS estimates roughly a 0.9% probability of exploitation within 30 days.

What to do: Upgrade Hermes Agent to a release that includes fix commit f6234d0 (i.e., any version newer than 0.21.0) and until then avoid opening untrusted repositories with the agent, or inspect their .git/config for a core.fsmonitor entry before use. Users who opened untrusted repositories while running a vulnerable version should rotate the AI provider API keys present in their environment.