# CVE-2026-49958: nesquena Hermes WebUI TOCTOU race condition in git_discard

Source: https://junglewise.ai/threats/cve-2026-49958-nesquena-hermes-webui-toctou-race-condition-in-git-discard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-49958 · Severity: medium · CVSS 5 · Published 2026-06-09

Hermes WebUI is a management interface for workspace operations. A security flaw in its Git cleanup process allows a local attacker to trick the system into deleting files outside of the intended workspace. This could lead to the accidental or malicious removal of critical system files or data stored elsewhere on the server, potentially causing service outages or data loss.

Technologies: [Nesquena Hermes WebUI](https://junglewise.ai/threats/technologies/hermes-webui). Vendors: [Nesquena](https://junglewise.ai/threats/vendors/nesquena).

## Quick answers

**Is CVE-2026-49958 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49958 being exploited in the wild.

**How severe is CVE-2026-49958?** Medium severity, with a CVSS score of 5, published 9 June 2026.

**Which products and versions are affected?** Nesquena Hermes WebUI < 0.51.303.

**Is there a fix for CVE-2026-49958?** A patch was published on 2026-06-06: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49958 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-49958?** Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the git_discard function within api/workspace_git.py. The application performs a containment check using safe_resolve_ws() but subsequently uses standard Path.unlink() or shutil.rmtree() calls for deletion. An attacker with local workspace access can replace a validated path component with a symbolic link after the validation check but before the deletion occurs. This causes the application to follow the symlink and delete files or directories outside the configured workspace. The vulnerability is mitigated in version 0.51.303 by using anchored deletion helpers (unlink_anchored and rmtree_anchored) that verify the boundary at the time of the operation.

## Affected products

- nesquena Hermes WebUI < 0.51.303

## Timeline

- 2026-06-06: patched: Fix committed to repository
- 2026-06-09: disclosed: CVE published

## References

- [https://github.com/nesquena/hermes-webui/commit/4580f584964d640b95c4ffc9245a21ab926bec73](https://github.com/nesquena/hermes-webui/commit/4580f584964d640b95c4ffc9245a21ab926bec73)
- [https://github.com/nesquena/hermes-webui/pull/3702](https://github.com/nesquena/hermes-webui/pull/3702)
- [https://github.com/nesquena/hermes-webui/pull/3756](https://github.com/nesquena/hermes-webui/pull/3756)
- [https://github.com/nesquena/hermes-webui/releases/tag/v0.51.303](https://github.com/nesquena/hermes-webui/releases/tag/v0.51.303)
- [https://www.vulncheck.com/advisories/hermes-webui-toctou-race-condition-via-git-discard](https://www.vulncheck.com/advisories/hermes-webui-toctou-race-condition-via-git-discard)

## Related threats

- [nesquena Hermes WebUI unauthenticated RCE in terminal API](https://junglewise.ai/threats/cve-2026-58123-nesquena-hermes-webui-unauthenticated-rce-in-terminal-api)
- [nesquena Hermes WebUI authorization bypass in session import](https://junglewise.ai/threats/cve-2026-58174-nesquena-hermes-webui-authorization-bypass-in-session-import)
- [nesquena Hermes WebUI authorization bypass in session export endpoint](https://junglewise.ai/threats/cve-2026-55198-nesquena-hermes-webui-authorization-bypass-in-session-export)
- [Hermes WebUI broken access control in /api/session endpoint](https://junglewise.ai/threats/cve-2026-55197-hermes-webui-broken-access-control-in-api-session-endpoint)
- [nesquena Hermes WebUI workspace boundary bypass in remote terminal resolution](https://junglewise.ai/threats/cve-2026-49957-nesquena-hermes-webui-workspace-boundary-bypass-in-remote)