CVE-2026-49959CWE-78

Hermes WebUI < 0.51.311 RCE via Git Configuration Injection

High · published June 9, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
69.5
In the wild
Unconfirmed
What it is

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in api/workspace_git.py through vectors such as core.fsmonitor during git status, protocol.ext.allow with ext:: remotes during git fetch, credential.helper, core.askPass, core.gitProxy, or inherited environment variables including GIT_SSH_COMMAND to achieve arbitrary command execution on the host running the application.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01266 · 69.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-09T16:46Z
EPSS history
Timeline
  • 09 JUN 16:46Z
    Hermes WebUI < 0.51.311 RCE via Git Configuration Injection
    cvelistv5