Vulnerability · Published Jan 12, 2026 · Assigned by GitHub_M

CVE-2026-22798hermes's raw options logging may disclose secrets passed in via subcommand options argument

Medium 5.9

In plain English

A medium-severity sensitive data in logs in hermes from softwarepub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 93.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens (e.g., via hermes deposit -O invenio_rdm.auth_token SECRET), these are written to the log file in plain text, making them available to whoever can access the log file. This vulnerability is fixed in 0.9.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	hermes	0.9.1	GHSA-jm5j-jfrm-hm23
PyPI	hermes	0.9.1	PYSEC-2026-1449

Affected products (as reported)

Vendor	Product	Versions
softwarepub	hermes	>= 0.8.1, < 0.9.1

Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

References

https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23 x_refsource_CONFIRM
https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1 x_refsource_MISC
https://github.com/softwarepub/hermes/commit/90cb86acd026e7841f2539ae7a1b284a7f263514 x_refsource_MISC