Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck

CVE-2026-71963Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection

High 8.8

In plain English

A high-severity OS command injection in hermes-agent from NousResearch. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.9%top 41.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.

Affected products (as reported)

Vendor	Product	Versions
NousResearch	hermes-agent	0.18.2 – through 0.21.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Manifold Blog technical-description, exploit
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/hermes-agent-rce-via-git-core-fsmonitor-config-injection third-party-advisory