CVE-2026-49959: Hermes WebUI < 0.51.311 RCE via Git Configuration Injection

Synopsis

This is a remote code execution vulnerability in Hermes WebUI, a web-based workspace management application. An authenticated attacker can reach the vulnerable endpoint over the network and inject malicious directives into a workspace repository's .git/config file, causing Git subprocesses to execute arbitrary operating system commands. Successful exploitation gives the attacker full command execution on the host running Hermes WebUI. A patched-image rebuild at version 0.51.311 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Hermes WebUI service over the network; the CVSS vector specifies AV:N, meaning the vulnerable API endpoint is exposed to network-accessible clients.

• AuthenticationRequired

  A valid account is required to exploit this vulnerability; the CVSS vector specifies PR:L, meaning any low-privilege authenticated user is sufficient and no admin account is needed.

• Victim interactionNot required

  No action by any other user or victim is needed; the attacker triggers the exploit entirely through their own requests to the API.

• Attack complexityDetail

  The CVSS vector specifies AC:L, meaning the exploit is reliable and requires no special race conditions, timing windows, or environmental prerequisites beyond authentication.

Blast Radius

• The attacker executes arbitrary operating system commands on the host running Hermes WebUI, gaining full control of that process and its filesystem access.
• All data the application can read is exposed, including workspace contents, stored credentials, configuration secrets, and any secrets mounted into the container at runtime.
• The attacker can modify or delete application data, workspace files, and any persisted state the running process has write access to.
• The application process itself and any dependent services it communicates with can be disrupted or terminated, causing a service outage.