Is CVE-2026-71963 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71963 being exploited in the wild.

How severe is CVE-2026-71963?

High severity, with a CVSS score of 8.8, published 3 September 2026.

Which products and versions are affected?

Nous Research Hermes Agent 0.18.2 through 0.21.0.

Is there a fix for CVE-2026-71963?

A patch was published on 2026-09-02: Fixed in commit f6234d0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71963 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-71963?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71963: Nous Research Hermes Agent remote code execution in git config

CVE-2026-71963 · Severity: high · CVSS 8.8 · Published 2026-09-03

Hermes Agent is an AI coding assistant that automatically analyzes repository content by running git commands. A malicious repository can exploit this by including a crafted .git/config file that executes arbitrary commands when the agent opens the repository and processes any message. This allows an attacker to steal API keys and other sensitive environment variables from the developer's machine without any visible warning.

Quick answers

Is CVE-2026-71963 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71963 being exploited in the wild.
How severe is CVE-2026-71963?: High severity, with a CVSS score of 8.8, published 3 September 2026.
Which products and versions are affected?: Nous Research Hermes Agent 0.18.2 through 0.21.0.
Is there a fix for CVE-2026-71963?: A patch was published on 2026-09-02: Fixed in commit f6234d0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71963 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-71963?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a command injection flaw in how Hermes Agent handles git configuration when automatically probing workspace context. The root cause is that git commands are executed against session directories without stripping repository-specific configuration, allowing an attacker to set execution-sink settings like core.fsmonitor, core.hooksPath, or pager to arbitrary commands. Attack vector is delivery of a malicious repository (via zip, sync folder, or shared storage—not via git clone, which excludes .git/config). No user interaction beyond opening the repository and sending a message is required. An attacker gains code execution in the user's process context with access to all environment variables including API keys. The vulnerability was fixed in commit f6234d0 by routing automatic git probes through noninteractive_git_env() to pin execution-sink settings to inert values and adding harden_git_argv() to block diff textconv drivers.

Affected products

Nous Research Hermes Agent 0.18.2 through 0.21.0

Timeline

2026-09-03: disclosed
2026-09-02: patched: Fixed in commit f6234d0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.