Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.

Hermes Agent versions 0.18.2 through 0.21.0 contain a critical remote code execution vulnerability tracked as CVE-2026-71963. Attackers can exploit this by supplying a malicious Git repository with a crafted .git/config file that sets the core.fsmonitor option to an attacker-controlled command. When a victim opens the repository and sends any message, the agent triggers a git status index refresh, which executes the injected command in the user's process context. This exposure can leak sensitive environment variables including configured provider API keys. The vulnerability has been fixed in commit f6234d0. Multiple security researchers and firms have published advisories and blog posts detailing the attack vector. The issue highlights the risk of AI coding agents automatically processing untrusted repository configurations.