CVE-2026-49958 describes a TOCTOU race condition in the nesquena hermes-webui product, specifically in the git_discard function within api/workspace_git.py. The vulnerability allows an attacker with limited privileges to replace a validated workspace path component with a symlink to an external directory after the safe_resolve_ws() validation but before the deletion operation (Path.unlink() or shutil.rmtree()). This causes the deletion operation to follow the symlink and remove arbitrary files outside the configured workspace boundary, potentially leading to unauthorized file deletion on the host system.

An attacker with the ability to influence workspace paths can cause the application to delete arbitrary files outside the intended workspace. This can lead to loss of data or disruption of system files. The CVSS 4.3 score reflects a medium severity with local attack vector, high attack complexity, and limited privileges required. There is no indication of remote exploitation or privilege escalation beyond the deletion capability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should restrict access to the workspace and monitor for suspicious file operations. Avoid running the affected function with elevated privileges. Follow vendor updates for an official fix or temporary mitigation.