Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-03 | 1 | Patch1 |
| 2026-09-07 | 1 | General1 |
| 2026-09-23 | 1 | Patch1 |
Affected agents named in the disclosure: Claude Code, OpenAI Codex, Cursor, Goose, Nous Hermes Agent, Qwen Code, and xAI Grok Build. CVEs assigned include CVE-2026-71963 and CVE-2026-55607.
Post summary
The disclosure merely lists the affected agents and assigns two CVEs, without providing additional evidence of exploitation, patches, or technical specifics.
cursor and codex patched the gitspawn class. hermes still open on 0.21.0, cve-2026-71963, six contacts, no triage agent runs git status for context, repo .git/config names a command, host runs it outside the sandbox before you typed anything not because the model is insecure, because the harness trusted the folder's plumbing
Post summary
The passage notes that cursor and codex have patched the gitspawn class for CVE‑2026‑71963, while Hermes 0.21.0 remains unpatched. It also outlines an exploitation approach using Git configuration but lacks evidence of active attacks or a PoC.
Hermes Agent CVE-2026-71963: malicious .git/config with core.fsmonitor fires when the agent refreshes git status after you send a message. Full environment. Provider API keys included. Do not open untrusted repo archives in affected Hermes builds. Patch past commit f6234d0. Do not treat the 0.21.0 tag as fixed just because it exists. https://hol.org/blog/cve-2026-71963-hermes-agent-git-config-rce-before-prompt
Post summary
The post describes CVE-2026-71963 in Hermes Agent where a malicious .git/config core.fsmonitor setting can lead to RCE upon git status refresh, and it directs users to apply the patch at commit f6234d0 rather than relying on the 0.21.0 tag.