The vulnerability in nesquena hermes-webui involves improper handling of environment variables during profile switching. When a user switches profiles, environment variables from the prior profile remain set and are not cleared before the new profile's variables are loaded. This additive dotenv reload behavior can be exploited by attackers or users to access sensitive secrets, including provider API keys, from one profile while operating in another. This breaks the intended security isolation between profiles, potentially exposing confidential data. The CVSS 4.8 score reflects a medium severity with local attack vector and low complexity.

Sensitive environment variables such as API keys and secrets can be exposed across profile boundaries, violating security isolation. This could lead to unauthorized access to resources or services that rely on these secrets. However, exploitation requires local access with low privileges and does not involve user interaction or network attack vectors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid switching profiles in a way that relies on environment variable isolation or manually clear environment variables between profile switches to prevent leakage.