CVE-2026-49959: Hermes WebUI RCE Vulnerability

CVE-2026-49959 Overview

CVE-2026-49959 is a remote code execution vulnerability in Hermes WebUI versions before 0.51.311. Authenticated attackers can place a malicious .git/config file in a workspace repository to execute arbitrary commands on the host. The flaw resides in Git subprocess invocations within api/workspace_git.py, which honor attacker-controlled Git configuration directives. Exploitation vectors include core.fsmonitor, protocol.ext.allow, credential.helper, core.askPass, core.gitProxy, and inherited environment variables such as GIT_SSH_COMMAND. The vulnerability is categorized under [CWE-78] OS Command Injection.

Critical Impact
Authenticated attackers can achieve arbitrary command execution on the host running Hermes WebUI by injecting executable Git configuration into a workspace repository.

Affected Products

Hermes WebUI versions prior to 0.51.311
The api/workspace_git.py workspace Git integration component
Hosts running vulnerable Hermes WebUI deployments with accessible workspace repositories

Discovery Timeline

2026-06-09 - CVE-2026-49959 published to the National Vulnerability Database (NVD)
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-49959

Vulnerability Analysis

The vulnerability stems from how Hermes WebUI invokes the git binary against workspace repositories. Git honors directives defined in a repository's local .git/config file. When the application runs operations such as git status or git fetch against an attacker-controlled repository, malicious configuration values are evaluated by Git itself. Several Git configuration keys accept executable commands or program paths, which Git invokes as subprocesses during normal operations. Attackers exploit this trust boundary to escape the intended Git workflow and execute arbitrary commands in the context of the Hermes WebUI process.

Root Cause

The Hermes WebUI workspace Git subsystem invokes Git subprocesses without scrubbing or overriding dangerous repo-local configuration keys. Git settings including core.fsmonitor, core.sshCommand, core.askPass, credential.helper, protocol.ext.allow, and core.gitProxy may all reference executable commands. Inherited environment variables such as GIT_SSH_COMMAND, GIT_ASKPASS, SSH_ASKPASS, and GIT_SSH further extend the attack surface by altering Git's external program invocations at runtime.

Attack Vector

An authenticated attacker introduces a workspace repository containing a crafted .git/config file. When Hermes WebUI performs a routine Git operation, Git reads the malicious configuration and spawns the attacker-defined command. For example, setting core.fsmonitor to an arbitrary binary causes Git to execute that binary during git status. Setting protocol.ext.allow=always combined with an ext:: remote URL triggers command execution during git fetch. The classification under [CWE-78] reflects the OS command injection nature of the issue.

python

     "GIT_CONFIG_SYSTEM",
     "GIT_CONFIG_COUNT",
     "GIT_CONFIG_PARAMETERS",
+    "GIT_ASKPASS",
+    "SSH_ASKPASS",
+    "GIT_SSH",
+    "GIT_SSH_COMMAND",
 )
 _GIT_ENV_SCRUB_PREFIXES = ("GIT_CONFIG_KEY_", "GIT_CONFIG_VALUE_")
 _HERMES_BRANCH_SWITCH_STASH_PREFIX = "hermes-webui branch switch"
_GIT_HARDENED_CONFIG = (
    ("core.fsmonitor", "false"),
    ("core.sshCommand", "ssh"),
    ("core.askPass", ""),
    ("credential.helper", ""),
    ("protocol.ext.allow", "never"),
    ("core.gitProxy", ""),
)

def _hardened_git_argv(args: list[str]) -> list[str]:
    argv = ["git"]

Source: GitHub Commit 938ac9f. The patch adds dangerous environment variables to the scrub list and forces hardened Git configuration values that neutralize repo-local overrides.

Detection Methods for CVE-2026-49959

Indicators of Compromise

Workspace repository .git/config files containing core.fsmonitor, core.sshCommand, core.gitProxy, core.askPass, credential.helper, or protocol.ext.allow values referencing external commands or scripts
Git remote URLs using the ext:: protocol scheme within workspace repositories
Unexpected child processes spawned by the Hermes WebUI service account during git status or git fetch operations
Outbound network connections originating from Git-invoked helper processes that do not match legitimate remote endpoints

Detection Strategies

Audit all workspace repositories for .git/config keys that reference executable commands and compare against an allowlist of legitimate values
Monitor process trees where the Hermes WebUI parent spawns git, which in turn spawns shells, interpreters, or non-Git binaries
Inspect environment variables in the Hermes WebUI process for GIT_SSH_COMMAND, GIT_ASKPASS, SSH_ASKPASS, or GIT_SSH set to unexpected values

Monitoring Recommendations

Enable process auditing on hosts running Hermes WebUI and alert on non-standard descendants of the git binary
Forward Hermes WebUI application logs and host telemetry to a centralized analytics platform for correlation
Track new or modified .git/config files in workspace storage volumes using file integrity monitoring

How to Mitigate CVE-2026-49959

Immediate Actions Required

Upgrade Hermes WebUI to version 0.51.311 or later, which introduces hardened Git argv construction and environment scrubbing
Inventory existing workspace repositories and remove any .git/config files containing executable directives
Restrict authenticated access to Hermes WebUI to trusted users until the upgrade is applied

Patch Information

The fix is delivered in commit 938ac9f and released as Hermes WebUI v0.51.311. The change scrubs GIT_ASKPASS, SSH_ASKPASS, GIT_SSH, and GIT_SSH_COMMAND from the Git child process environment. It also forces neutral values for core.fsmonitor, core.sshCommand, core.askPass, credential.helper, protocol.ext.allow, and core.gitProxy via -c arguments. See the VulnCheck RCE Advisory and Pull Request #3776 for additional context.

Workarounds

Run Hermes WebUI under a low-privilege service account with no shell access and minimal filesystem permissions
Apply egress network controls so Git-invoked helpers cannot reach attacker-controlled infrastructure
Manually pass hardened -c flags such as -c core.fsmonitor=false -c protocol.ext.allow=never -c core.gitProxy= when invoking Git against untrusted repositories until upgrading

bash

# Configuration example: invoke Git with hardened flags
git \
  -c core.fsmonitor=false \
  -c core.sshCommand=ssh \
  -c core.askPass= \
  -c credential.helper= \
  -c protocol.ext.allow=never \
  -c core.gitProxy= \
  status