TOCTOU Race Condition Vulnerability in Hermes WebUI by nesquena

CVE-2026-49958

What is CVE-2026-49958?

Hermes WebUI prior to version 0.51.303 is susceptible to a time-of-check time-of-use (TOCTOU) race condition in the git_discard function found in api/workspace_git.py. This vulnerability permits an attacker to delete files outside the defined workspace boundary by exploiting a symlink. Specifically, the attacker can substitute a controlled path component with a symlink pointing to an external directory between the safe_resolve_ws() validation phase and the execution of the deletion commands (Path.unlink() or shutil.rmtree()). Consequently, this can lead to unintended file removals beyond the intended workspace, significantly compromising data integrity.

References