A critical remote code execution vulnerability in Hermes Agent allows attackers to execute arbitrary OS commands when a user interacts with a specially crafted git repository.

The vulnerability exists due to improper neutralization of special elements in an OS command (CWE-78), where the application fails to sanitize git configurations. An unauthenticated attacker can supply a repository with a malicious .git/config file that leverages the core.fsmonitor setting to execute arbitrary commands within the user's process context.

Successful exploitation grants an attacker the ability to execute arbitrary code on the developer's machine with the user's full privileges. This bypasses typical sandboxing and can lead to the exfiltration of sensitive information, including cloud provider API keys, SSH keys, and access to all repositories on the local disk. Given the CVSS score of 8.8, this poses a severe risk to organizational intellectual property and infrastructure integrity.

Immediate Action: Update the Hermes Agent to the version containing the fix for commit f6234d00c5d59450adea1d7edd30ad3859375c79.

Proactive Monitoring: Review system and process logs for unexpected child processes spawned by the Hermes Agent or git-related commands.

Compensating Controls: Avoid opening git repositories from untrusted sources or shared archives (such as .zip files) until the agent has been updated. Ensure that sensitive API keys are not stored in plaintext within the shell environment or configuration files.

Public Exploit Available: Yes — a published proof-of-concept exists and is documented in the Manifold Security research write-up.

The severity of this vulnerability necessitates immediate attention, as it provides a pathway for full machine compromise without requiring user interaction beyond opening a repository. Organizations utilizing Hermes Agent must prioritize updating to the patched version across all development environments to eliminate the risk of command injection through malicious repository configurations.