Executive brief
Hermes Agent is an AI coding assistant that automatically analyzes repository content by running git commands. A malicious repository can exploit this by including a crafted .git/config file that executes arbitrary commands when the agent opens the repository and processes any message. This allows an attacker to steal API keys and other sensitive environment variables from the developer's machine without any visible warning.
Technical details
The vulnerability is a command injection flaw in how Hermes Agent handles git configuration when automatically probing workspace context. The root cause is that git commands are executed against session directories without stripping repository-specific configuration, allowing an attacker to set execution-sink settings like core.fsmonitor, core.hooksPath, or pager to arbitrary commands. Attack vector is delivery of a malicious repository (via zip, sync folder, or shared storage—not via git clone, which excludes .git/config). No user interaction beyond opening the repository and sending a message is required. An attacker gains code execution in the user's process context with access to all environment variables including API keys. The vulnerability was fixed in commit f6234d0 by routing automatic git probes through noninteractive_git_env() to pin execution-sink settings to inert values and adding harden_git_argv() to block diff textconv drivers.
Affected products
- Nous Research Hermes Agent 0.18.2 through 0.21.0
Timeline
- 2026-09-03: disclosed
- 2026-09-02: patched: Fixed in commit f6234d0