Threats affecting pkg:github/hermes-agent

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.

Hermes Agent versions prior to 0.19.0 contain a supply chain vulnerability in their bundled MCP catalog. This flaw allows remote attackers to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch instead of a pinned commit SHA. Exploitation requires no further operator action once the malicious code is propagated through the affected catalog entry.

Hermes Agent versions 0.16.0 up to but not including 0.17.0 contain a vulnerability where attackers can bypass path restrictions to overwrite the credential store file auth.json. This improper path restriction allows crafted messages to direct file-write operations to sensitive files, enabling credential tampering or unauthorized access. The vulnerability has a high severity score of 7.6 and requires user interaction but no privileges. No official patch or remediation guidance is currently confirmed.

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including conversation history, tool payloads, prompts, and per-route HMAC secrets.

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling attackers to exploit DNS rebinding and inject malicious commands or read terminal output.