High
Hermes WebUI < 0.51.311 RCE via Git Configuration Injection
Type: advisorySources: OSV
Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in api/workspace_git.py through vectors such as core.fsmonitor during git status, protocol.ext.allow with ext:: remotes during git fetch, credential.helper, core.askPass, core.gitProxy, or inherited environment variables including GIT_SSH_COMMAND to achieve arbitrary command execution on the host running the application.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-49959
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 09:48 UTC · Revision 1
Source evidence
Hermes WebUI < 0.51.311 RCE via Git Configuration Injection
core-osv · Original sourcePublished 9 Jun 2026, 16:46 UTC
Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in api/workspace_git.py through vectors such as core.fsmonitor during git status, protocol.ext.allow with ext:: remotes during git fetch, credential.helper, core.askPass, core.gitProxy, or inherited environment variables including GIT_SSH_COMMAND to achieve arbitrary command execution on the host running the application.
osv:CVE-2026-49959
Complete source record
{
"id": "cf53ed8629e83ca0bdb83134740c6bb5b003ea4f43c82e11a296c2274923e4fa",
"url": "https://osv.dev/vulnerability/CVE-2026-49959",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Hermes WebUI < 0.51.311 RCE via Git Configuration Injection",
"summary": "Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in api/workspace_git.py through vectors such as core.fsmonitor during git status, protocol.ext.allow with ext:: remotes during git fetch, credential.helper, core.askPass, core.gitProxy, or inherited environment variables including GIT_SSH_COMMAND to achieve arbitrary command execution on the host running the application.",
"evidence": "osv:CVE-2026-49959",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-49959",
"aliases": [
"CVE-2026-49959"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nesquena/hermes-webui",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "938ac9f55b53def1eefb48c4c42dabaf9c22e99c"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.51.311"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "938ac9f55b53def1eefb48c4c42dabaf9c22e99c"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.51.311"
},
{
"range": [
{
"fixed": "938ac9f55b53def1eefb48c4c42dabaf9c22e99c"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.51.311"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"v0.51.310",
"v0.51.309",
"v0.51.308",
"v0.51.307",
"v0.51.306",
"v0.51.305",
"v0.51.304",
"v0.51.303",
"v0.51.302",
"v0.51.301",
"v0.51.300",
"v0.51.299",
"v0.51.298",
"v0.51.297",
"v0.51.296",
"v0.51.295",
"v0.51.294",
"v0.51.293",
"v0.51.292",
"v0.51.291",
"v0.51.290",
"v0.51.289",
"v0.51.288",
"v0.51.287",
"v0.51.286",
"v0.51.285",
"v0.51.284",
"v0.51.283",
"v0.51.282",
"v0.51.281",
"v0.51.280",
"v0.51.279",
"v0.51.278",
"v0.51.277",
"v0.51.276",
"v0.51.275",
"v0.51.274",
"v0.51.273",
"v0.51.272",
"v0.51.271",
"v0.51.270",
"v0.51.269",
"v0.51.268",
"v0.51.267",
"v0.51.266",
"v0.51.265",
"v0.51.264",
"v0.51.263",
"v0.51.262",
"v0.51.261",
"v0.51.260",
"v0.51.259",
"v0.51.258",
"v0.51.257",
"v0.51.256",
"v0.51.255",
"v0.51.254",
"v0.51.253",
"v0.51.252",
"v0.51.251",
"v0.51.250",
"v0.51.249",
"v0.51.248",
"v0.51.247",
"v0.51.246",
"v0.51.245",
"v0.51.244",
"v0.51.243",
"v0.51.242",
"v0.51.241",
"v0.51.240",
"v0.51.239",
"v0.51.238",
"v0.51.237",
"v0.51.236",
"v0.51.235",
"v0.51.234",
"v0.51.233",
"v0.51.232",
"v0.51.231",
"v0.51.230",
"v0.51.229",
"v0.51.228",
"v0.51.227",
"v0.51.226",
"v0.51.225",
"v0.51.224",
"v0.51.223",
"v0.51.222",
"v0.51.221",
"v0.51.220",
"v0.51.219",
"v0.51.218",
"v0.51.217",
"v0.51.216",
"v0.51.215",
"v0.51.214",
"v0.51.213",
"v0.51.212",
"v0.51.211",
"v0.51.210",
"v0.51.209",
"v0.51.208",
"v0.51.207",
"v0.51.206",
"v0.51.205",
"v0.51.204",
"v0.51.203",
"v0.51.202",
"v0.51.201",
"v0.51.200",
"v0.51.199",
"v0.51.198",
"v0.51.197",
"v0.51.196",
"v0.51.195",
"v0.51.194",
"v0.51.193",
"v0.51.192",
"v0.51.191",
"v0.51.190",
"v0.51.189",
"v0.51.188",
"v0.51.187",
"v0.51.186",
"v0.51.185",
"v0.51.184",
"v0.51.182",
"v0.51.157",
"v0.51.183",
"v0.51.181",
"v0.51.180",
"v0.51.179",
"v0.51.178",
"v0.51.177",
"v0.51.176",
"v0.51.175",
"v0.51.174",
"v0.51.173",
"v0.51.172",
"v0.51.171",
"v0.51.169",
"v0.51.170",
"v0.51.168",
"v0.51.167",
"v0.51.166",
"v0.51.165",
"v0.51.164",
"v0.51.163",
"v0.51.162",
"v0.51.161",
"v0.51.160",
"v0.51.159",
"v0.51.158",
"v0.51.156",
"v0.51.155",
"v0.51.154",
"v0.51.153",
"v0.51.152",
"v0.51.145",
"v0.51.151",
"v0.51.150",
"v0.51.149",
"v0.51.148",
"v0.51.147",
"v0.51.146",
"v0.51.141",
"v0.51.144",
"v0.51.143",
"v0.51.142",
"v0.51.139",
"v0.51.140",
"v0.51.138",
"v0.51.137",
"v0.51.136",
"v0.51.135",
"v0.51.134",
"v0.51.133",
"v0.51.132",
"v0.51.131",
"v0.51.130",
"v0.51.129",
"v0.51.128",
"v0.51.127",
"v0.51.126",
"v0.51.125",
"v0.51.124",
"v0.51.123",
"v0.51.122",
"v0.51.121",
"v0.51.120",
"v0.51.119",
"v0.51.118",
"v0.51.117",
"v0.51.116",
"v0.51.115",
"v0.51.114",
"v0.51.113",
"v0.51.112",
"v0.51.111",
"v0.51.110",
"v0.51.109",
"v0.51.108",
"v0.51.107",
"v0.51.106",
"v0.51.105",
"v0.51.104",
"v0.51.103",
"v0.51.102",
"v0.51.101",
"v0.51.100",
"v0.51.99",
"v0.51.98",
"v0.51.97",
"v0.51.96",
"v0.51.95",
"v0.51.94",
"v0.51.93",
"v0.51.92",
"v0.51.91",
"v0.51.90",
"v0.51.89",
"v0.51.88",
"v0.51.87",
"v0.51.86",
"v0.51.85",
"v0.51.84",
"v0.51.83",
"v0.51.82",
"v0.51.61",
"v0.51.81",
"v0.51.80",
"v0.51.79",
"v0.51.78",
"v0.51.77",
"v0.51.76",
"v0.51.75",
"v0.51.74",
"v0.51.73",
"v0.51.72",
"v0.51.71",
"v0.51.70",
"v0.51.69",
"v0.51.68",
"v0.51.67",
"v0.51.66",
"v0.51.65",
"v0.51.64",
"v0.51.63",
"v0.51.62",
"v0.51.60",
"v0.51.59",
"v0.51.58",
"v0.51.57",
"v0.51.54",
"v0.51.56",
"v0.51.55",
"v0.51.52",
"v0.51.53",
"v0.51.50",
"v0.51.51",
"v0.51.34",
"v0.51.49",
"v0.51.48",
"v0.51.47",
"v0.51.46",
"v0.51.45",
"v0.50.278",
"v0.51.44",
"v0.51.43",
"v0.51.42",
"v0.51.41",
"v0.51.40",
"v0.51.39",
"v0.51.38",
"v0.51.37",
"v0.51.36",
"v0.51.35",
"v0.51.31",
"v0.51.33",
"v0.51.32",
"v0.51.30",
"v0.51.29",
"v0.51.28",
"v0.51.27",
"v0.51.26",
"v0.51.25",
"v0.51.24",
"v0.51.23",
"v0.51.22",
"v0.51.21",
"v0.51.20",
"v0.51.19",
"v0.51.18",
"v0.51.17",
"v0.51.16",
"v0.51.15",
"v0.51.14",
"v0.51.13",
"v0.51.12",
"v0.51.11",
"v0.51.10",
"v0.51.9",
"v0.51.8",
"v0.51.7",
"v0.51.6",
"v0.51.5",
"v0.51.4",
"v0.51.3",
"v0.51.2",
"v0.51.1",
"v0.51.0",
"v0.50.297",
"v0.50.296",
"v0.50.295",
"v0.50.294",
"v0.50.293",
"v0.50.292",
"v0.50.291",
"v0.50.290",
"v0.50.289",
"v0.50.288",
"v0.50.287",
"v0.50.286",
"v0.50.285",
"v0.50.284",
"v0.50.283",
"v0.50.282",
"v0.50.281",
"v0.50.280",
"v0.50.279",
"v0.50.277",
"v0.50.276",
"v0.50.275",
"v0.50.274",
"v0.50.273",
"v0.50.272",
"v0.50.271",
"v0.50.270",
"v0.50.269",
"v0.50.268",
"v0.50.267",
"v0.50.266",
"v0.50.265",
"v0.50.263",
"v0.50.264",
"v0.50.261",
"v0.50.262",
"v0.50.260",
"v0.50.259",
"v0.50.258",
"v0.50.257",
"v0.50.256",
"v0.50.255",
"v0.50.254",
"v0.50.253",
"v0.50.252",
"v0.50.251",
"v0.50.250",
"v0.50.249",
"v0.50.248",
"v0.50.247",
"v0.50.246",
"v0.50.245",
"v0.50.244",
"v0.50.243",
"v0.50.242",
"v0.50.241",
"v0.50.240",
"v0.50.239",
"v0.50.238",
"v0.50.237",
"v0.50.236",
"v0.50.235",
"v0.50.233",
"v0.50.232",
"v0.50.231",
"v0.50.230",
"v0.50.229",
"v0.50.228",
"v0.50.227",
"v0.50.226",
"v0.50.225",
"v0.50.224",
"v0.50.223",
"v0.50.222",
"v0.50.221",
"v0.50.220",
"v0.50.219",
"v0.50.218",
"v0.50.217",
"v0.50.216",
"v0.50.215",
"v0.50.214",
"v0.50.212",
"v0.50.211",
"v0.50.210",
"v0.50.209",
"v0.50.208",
"v0.50.207",
"v0.50.206",
"v0.50.205",
"v0.50.204",
"v0.50.203",
"v0.50.202",
"v0.50.200",
"v0.50.199",
"v0.50.198",
"v0.50.197",
"v0.50.196",
"v0.50.195",
"v0.50.194",
"v0.50.193",
"v0.50.192",
"v0.50.191",
"v0.50.190",
"v0.50.189",
"v0.50.188",
"v0.50.187",
"v0.50.186",
"v0.50.185",
"v0.50.184",
"v0.50.183",
"v0.50.182",
"v0.50.181",
"v0.50.180",
"v0.50.179",
"v0.50.178",
"v0.50.177",
"v0.50.176",
"v0.50.175",
"v0.50.174",
"v0.50.173",
"v0.50.172",
"v0.50.171",
"v0.50.170",
"v0.50.169",
"v0.50.168",
"v0.50.167",
"v0.50.166",
"v0.50.165",
"v0.50.164",
"v0.50.163",
"v0.50.162",
"v0.50.161",
"v0.50.160",
"v0.50.159",
"v0.50.158",
"v0.50.157",
"v0.50.156",
"v0.50.150",
"v0.50.147",
"v0.50.146",
"v0.50.145",
"v0.50.144",
"v0.50.143",
"v0.50.142",
"v0.50.141",
"v0.50.140",
"v0.50.139",
"v0.50.138",
"v0.50.137",
"v0.50.136",
"v0.50.135",
"v0.50.134",
"v0.50.133",
"v0.50.132",
"v0.50.131",
"v0.50.130",
"v0.50.129",
"v0.50.128",
"v0.50.127",
"v0.50.126",
"v0.50.125",
"v0.50.124",
"v0.50.123",
"v0.50.122",
"v0.50.121",
"v0.50.120",
"v0.50.119",
"v0.50.118",
"v0.50.117",
"v0.50.116",
"v0.50.115",
"v0.50.114",
"v0.50.113",
"v0.50.112",
"v0.50.111",
"v0.50.110",
"v0.50.109",
"v0.50.108",
"v0.50.96",
"v0.50.95",
"v0.50.94",
"v0.50.93",
"v0.50.92",
"v0.50.91",
"v0.50.90",
"v0.50.89",
"v0.50.88",
"v0.50.87",
"v0.50.86",
"v0.50.85",
"v0.50.84",
"v0.50.83",
"v0.50.82",
"v0.50.76",
"v0.50.75",
"v0.50.74",
"v0.50.73",
"v0.50.72",
"v0.50.71",
"v0.50.70",
"v0.50.69",
"v0.50.68",
"v0.50.67",
"v0.50.64",
"v0.50.63",
"v0.50.62",
"v0.50.61",
"v0.50.60",
"v0.50.59",
"v0.50.58",
"v0.50.57",
"v0.50.56",
"v0.50.55",
"v0.50.54",
"v0.50.53",
"v0.50.52",
"v0.50.51",
"v0.50.50",
"v0.50.49",
"v0.50.48",
"v0.50.47",
"v0.50.46",
"v0.50.45",
"v0.50.44",
"v0.50.43",
"v0.50.42",
"v0.50.41",
"v0.50.40",
"v0.50.39",
"v0.50.38",
"v0.50.37",
"v0.50.36",
"v0.50.35",
"v0.50.34",
"v0.50.33",
"v0.50.32",
"v0.50.31",
"v0.50.30",
"v0.50.29",
"v0.50.28",
"v0.50.27",
"v0.50.26",
"v0.50.25",
"v0.50.24",
"v0.50.23",
"v0.50.22",
"v0.50.21",
"v0.50.20",
"v0.50.19",
"v0.50.18",
"v0.50.17",
"v0.50.16",
"v0.50.15",
"v0.50.14",
"v0.50.13",
"v0.50.12",
"v0.50.11",
"v0.50.10",
"v0.50.9",
"v0.50.8",
"v0.50.7",
"v0.50.6",
"v0.50.5",
"v0.50.4",
"v0.50.3",
"v0.50.2",
"v0.50.1",
"v0.50.0",
"v0.49.4",
"v0.49.3",
"v0.49.2",
"v0.49.1",
"v0.49.0",
"v0.48.2",
"v0.48.1",
"v0.48.0",
"v0.47.1",
"v0.47.0",
"v0.46.0",
"v0.45.0",
"v0.44.1",
"v0.44.0",
"v0.43.1",
"v0.43.0",
"v0.42.2",
"v0.42.1",
"v0.42.0",
"v0.41.0",
"v0.40.2",
"v0.40.1",
"v0.40.0",
"v0.39.1",
"v0.39.0",
"v0.38.6",
"v0.38.5",
"v0.38.4",
"v0.38.3",
"v0.38.2",
"v0.38.1",
"v0.38.0",
"v0.37.0",
"v0.36.3",
"v0.36.2",
"v0.36.1",
"v0.36",
"v0.35.1",
"v0.35",
"v0.34.3",
"v0.34.2",
"v0.34.1",
"v0.34",
"v0.33",
"v0.32",
"v0.31.2",
"v0.31.1",
"v0.31",
"v0.30.4",
"v0.30.3",
"v0.30.2",
"v0.30.1",
"v0.30",
"v0.29",
"v0.28.1",
"v0.28",
"v0.27",
"v0.26",
"v0.25",
"v0.24",
"v0.23",
"v0.22",
"v0.21",
"v0.20",
"v0.19",
"v0.18.1",
"v0.18",
"v0.17.3",
"v0.17.2",
"v0.17.1",
"v0.16.2",
"v0.16.1",
"v0.16",
"v0.12"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49959.json"
}
}
],
"modified": "2026-10-28T02:30:27.837852206Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49959.json",
"https://github.com/nesquena/hermes-webui/releases/tag/v0.51.311",
"https://nvd.nist.gov/vuln/detail/CVE-2026-49959",
"https://www.vulncheck.com/advisories/hermes-webui-rce-via-git-configuration-injection",
"https://github.com/nesquena/hermes-webui/pull/3776",
"https://github.com/nesquena/hermes-webui/commit/938ac9f55b53def1eefb48c4c42dabaf9c22e99c",
"https://github.com/nesquena/hermes-webui"
],
"provider_metadata": {
"cwe_ids": [
"CWE-78"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49959.json"
}
},
"related_cves": [
{
"value": "CVE-2026-49959",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 494320,
"published_at": "2026-06-09T16:46:03.502+00:00"
}