Remote Code Execution Vulnerability in Hermes Agent by Nous Research
CVE-2026-71963

8.6HIGH

Key Information:

Vendor: Nousresearch
Status: Hermes-agent
Vendor: CVE Published:; 3 September 2026

🔔 Create Nousresearch Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-71963?

Hermes Agent versions 0.18.2 through 0.21.0 contain a vulnerability that permits remote code execution via a manipulated git configuration file. An attacker can exploit this weakness by providing a crafted .git/config that specifies an arbitrary command through the core.fsmonitor setting. When a user interacts with the compromised repository and sends any message, the agent activates a git status index refresh, leading to the execution of the injected command within the user's process context. This flaw not only allows for arbitrary command execution but can also disclose sensitive information such as configured API keys and other environment details.

Affected Version(s)

hermes-agent 0.18.2 <= 0.21.0

hermes-agent f6234d00c5d59450adea1d7edd30ad3859375c79

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-71963 - Proof of Concept