Is CVE-2026-49958 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49958 being exploited in the wild.

How severe is CVE-2026-49958?

Medium severity, with a CVSS score of 5, published 9 June 2026.

Which products and versions are affected?

Nesquena Hermes WebUI < 0.51.303.

Is there a fix for CVE-2026-49958?

A patch was published on 2026-06-06: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49958 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-49958?

Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49958: nesquena Hermes WebUI TOCTOU race condition in git_discard

Q: Is there a fix for CVE-2026-49958?

A patch was published on 2026-06-06: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49958 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2026-49958?

Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49958 · Severity: medium · CVSS 5 · Published 2026-06-09

Hermes WebUI is a management interface for workspace operations. A security flaw in its Git cleanup process allows a local attacker to trick the system into deleting files outside of the intended workspace. This could lead to the accidental or malicious removal of critical system files or data stored elsewhere on the server, potentially causing service outages or data loss.

Technologies: Nesquena Hermes WebUI. Vendors: Nesquena.

Quick answers

Is CVE-2026-49958 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49958 being exploited in the wild.
How severe is CVE-2026-49958?: Medium severity, with a CVSS score of 5, published 9 June 2026.
Which products and versions are affected?: Nesquena Hermes WebUI < 0.51.303.
Is there a fix for CVE-2026-49958?: A patch was published on 2026-06-06: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49958 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-49958?: Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the git_discard function within api/workspace_git.py. The application performs a containment check using safe_resolve_ws() but subsequently uses standard Path.unlink() or shutil.rmtree() calls for deletion. An attacker with local workspace access can replace a validated path component with a symbolic link after the validation check but before the deletion occurs. This causes the application to follow the symlink and delete files or directories outside the configured workspace. The vulnerability is mitigated in version 0.51.303 by using anchored deletion helpers (unlink_anchored and rmtree_anchored) that verify the boundary at the time of the operation.

Affected products

nesquena Hermes WebUI < 0.51.303

Timeline

2026-06-06: patched: Fix committed to repository
2026-06-09: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.