CVE-2026-49958 describes a TOCTOU race condition in nesquena's hermes-webui before version 0.51.303. The vulnerability exists in the git_discard function within api/workspace_git.py, where after a path is validated by safe_resolve_ws(), an attacker can substitute a workspace-controlled path component with a symlink to an external directory before the deletion operation (Path.unlink() or shutil.rmtree()) occurs. This allows deletion of arbitrary files outside the configured workspace boundary. The vulnerability requires local access with low privileges and user interaction, and the attack complexity is high.

An attacker with limited privileges and user interaction can exploit this race condition to delete arbitrary files outside the intended workspace directory. This could lead to loss of important files or disruption of system operations. The impact is limited by the need for local access and the complexity of the attack, reflected in the medium severity rating and CVSS score of 4.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid running hermes-webui versions prior to 0.51.303 in untrusted environments or restrict access to trusted users only. Monitor vendor communications for updates regarding an official patch or workaround.