Remote Code Execution Vulnerability in Hermes WebUI Affected by Malicious Git Configurations
CVE-2026-49959

8.7HIGH

Key Information:

Vendor

Nesquena

Status
Hermes-webui
Vendor
CVE Published:
9 June 2026

What is CVE-2026-49959?

Hermes WebUI before version 0.51.311 is susceptible to a remote code execution vulnerability that allows authenticated users to execute arbitrary commands. This flaw arises from the ability to manipulate Git configuration files, specifically the .git/config file within a workspace repository. Through various Git subprocess invocations, such as core.fsmonitor during git status and credential.helper, attackers can inject malicious commands that execute on the server hosting the application. Exploitation can occur via methods like modifying allowed protocol extensions during git fetch or by leveraging inherited environment variables. This vulnerability poses a significant threat to the integrity and security of systems running vulnerable versions of Hermes WebUI.

Affected Version(s)

hermes-webui 0

References

https://github.com/nesquena/hermes-webui/releases/tag/v0....
release-notes
https://github.com/nesquena/hermes-webui/pull/3776
issue-tracking
https://github.com/nesquena/hermes-webui/commit/938ac9f55...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chia Min Jun Lennon
.