Which versions of Hermes Agent are affected by CVE-2026-71963?

NousResearch Hermes Agent (versions 0.18.2-0.21.0) is vulnerable to unauthenticated remote code execution that directly exposes API keys and sensitive credentials from the agent's process…. A patch is available.

Is there a public PoC exploit available for CVE-2026-71963?

Yes, a public proof-of-concept exploit is available for CVE-2026-71963. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-71963?

Within 24 hours, identify all systems running NousResearch Hermes Agent versions 0.18.2-0.21.0 and immediately isolate or restrict access; audit recent repository activity for suspicious .git/config files containing core.fsmonitor directives. Within 7 days, apply vendor patch commit f6234d0 or newer to all affected instances and verify by confirming updated version in runtime output. Within 30 days, rotate all LLM provider API keys that may have been exposed, conduct forensic analysis of process environment logs during the vulnerability window, and implement input validation controls to prevent untrusted git configurations from being processed.

Hermes Agent CVE-2026-71963

Q: What is the CVSS score of CVE-2026-71963?

CVE-2026-71963 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-70526 HIGH

OS Command Injection (CWE-78)

2026-09-03 VulnCheck

GHSA-cc88-9pxf-j2wv

RCE Command Injection Hermes Agent Nousresearch

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network delivery via malicious repo, no privilege needed, but active user interaction (open repo + send message) required; full CIA impact on local process environment.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 03, 2026 - 19:21 vuln.today

Source Code Evidence Fetched

Sep 03, 2026 - 15:54 vuln.today

Analysis Generated

Sep 03, 2026 - 15:54 vuln.today

CVE Published

Sep 03, 2026 - 15:19 cve.org

HIGH 8.6

DescriptionCVE.org

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.

AnalysisAI

Remote code execution in NousResearch Hermes Agent 0.18.2-0.21.0 allows an unauthenticated attacker to execute arbitrary OS commands in the victim's process context by supplying a malicious git repository containing a crafted .git/config that sets core.fsmonitor to an attacker-controlled binary or script. Exploitation is triggered the moment a user opens the malicious repository and sends any message, causing the agent's internal git status call to invoke the injected command and expose the full process environment - including configured LLM provider API keys. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	The victim must open a git repository containing a malicious `.git/config` that sets `core.fsmonitor` to an attacker-controlled executable path - this is a repo-local configuration setting that git reads and applies without requiring any global or system-level configuration change. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:N/UI:A) accurately reflects a realistic attack requiring only that a victim open a malicious repository and issue any prompt - a one-step social-engineering bar achievable through supply chain, dependency confusion, or a shared repository link. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update to a build containing commit f6234d00c5d59450adea1d7edd30ad3859375c79 or any release tagged after that commit. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems running NousResearch Hermes Agent versions 0.18.2-0.21.0 and immediately isolate or restrict access; audit recent repository activity for suspicious .git/config files containing core.fsmonitor directives. …

Threat intelligence, references, and detailed analysis are available after sign-in.