CVE-2026-71963 is a high severity (CVSS 8.8) OS command injection in Hermes Agent 0.18.2 through 0.21.0. A malicious repository can set a git option that runs a command when the agent refreshes its git index. The fix is commit f6234d0, and I found no release number.
What's affected
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, per the record and VulnCheck. I could not confirm a released version that contains the fix, so check the project's releases for one that includes commit f6234d0 and pull request 101483.
The weakness is CWE-78. The advisory describes a repository whose .git/config sets core.fsmonitor to an attacker-chosen command. When a user opens that repository and sends any message, the agent runs a git status that refreshes the index, and git runs the configured command in the user's process context. That exposes the full environment, including configured provider API keys.
Severity differs by source: the record scores 8.8 high, and VulnCheck lists 8.6 high using CVSS 4.0. The vector shows user interaction required.
The Manifold Security research post that VulnCheck cites describes the same class of problem across several AI coding agents. Its findings are not all about Hermes Agent, so read it for context rather than as the status of this product.
How to check if you're exposed
Check the installed version through the package manager you used. For a Python install:
pip show hermes-agent | grep -i '^version'
Any version from 0.18.2 to 0.21.0 is in range unless you built from a source revision that already includes commit f6234d0. For source installs, check the git history:
git merge-base --is-ancestor f6234d0 HEAD && echo fixed
Then think about what the agent has been opened on. The risk comes from repositories that arrive as files with a .git directory already inside, for example from archives, shared drives or downloaded project folders. A normal clone does not carry repository config, so it is less of a concern, but treat the source of every workspace with care.
free in-browser dependency scan checks manifests for known vulnerabilities in packages.
What to do now
- Find the installed Hermes Agent version, and whether your build includes commit f6234d0.
- Update to a release that contains the fix, or to a source revision after it.
- Do not open repositories received as folders or archives from untrusted sources with an agent.
- Run agents in a container or virtual machine with no long lived credentials in the environment.
- Rotate provider API keys if you opened an untrusted folder with a vulnerable version.
Why it matters
CWE-78 in this case does not come from the agent building a bad command. It comes from git itself, which treats some settings in a repository's own config as commands to run. The agent runs ordinary git operations, and git does the rest. Any tool that runs git in a folder it did not create inherits this risk.
AI agents raise the stakes because they run git before and around user action, and they run in an environment full of credentials. The advisory notes the injected command sees the whole process environment, including API keys. The lasting defence is to keep secrets out of the environment where the agent runs.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does cloning a repository trigger this?
The Manifold post says git does not carry repository config in a clone, fetch or pull. The risk is a folder that arrives with its .git directory already inside, such as an archive or shared drive.
Sources
Last reviewed: 18 October 2026.
