AI analysis
Hermes Agent versions 0.18.2 through 0.21.0 contain an OS command injection flaw (CWE-78) in which the agent's git operations honor the core.fsmonitor setting in a repository's .git/config, letting that setting specify an attacker-controlled command. The attack is triggered when a user opens a crafted repository and sends any message, at which point the agent runs a git status index refresh that executes the injected command in the user's process context. A successful attacker gains arbitrary OS command execution with access to the user's full environment, including configured AI provider API keys, which can be exfiltrated. Anyone running an affected Hermes Agent version who opens untrusted or attacker-supplied repositories is exposed; the attack requires user interaction but no privileges or authentication on the target. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is currently known, and EPSS estimates roughly a 0.9% probability of exploitation within 30 days.
What to do: Upgrade Hermes Agent to a release that includes fix commit f6234d0 (i.e., any version newer than 0.21.0) and until then avoid opening untrusted repositories with the agent, or inspect their .git/config for a core.fsmonitor entry before use. Users who opened untrusted repositories while running a vulnerable version should rotate the AI provider API keys present in their environment.
Affected
| Hermes Agent | 0.18.2 through 0.21.0 (fixed in commit f6234d0) |
Estimated exposure
unknown - no public install or user counts exist for Hermes Agent; the population is plausibly small, as it is a niche developer tool rather than a mainstream… — No public active-install counts, scan data, or adoption metrics are available for the Hermes Agent project, so the exposed population cannot be quantified beyond noting it is a niche developer-facing tool adjacent to mainstream AI coding…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.