Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

NousResearch/hermes-agent

              main @ 2635035
            

549

Fixes

CVEs

CRITICAL

Peak severity

32.4%

Coverage

Highlights

Auth Bypass: 123 prior fixes. Scrutinize any change in this area.

gateway/run.py: most-fixed (41 issues). Treat as high-risk during review.

384 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The gateway authorization path has been patched over 30 times for bypasses: default-open allowlists, unscoped env reads, missing checks on slash commands/component buttons/busy-session paths, and relay-delivered events. Any new message-handling path must default-deny and route through _is_user_authorized with profile-scoped env.

Command Injection: The dangerous-command detection gate has been bypassed repeatedly via shell obfuscation: line continuations, quoted paths, brace expansion, heredocs, prefix wrappers (sudo/env/nohup), and decode-and-execute pipes. Every new command-execution path must route through the hardened detect_dangerous_command/check_all_command_guards with the hardline blocklist.

Information Disclosure: Cross-profile credential leakage via unscoped os.getenv/os.environ reads is the most common information-disclosure pattern. Fixes repeatedly route reads through get_secret()/secret_scope and add fail-closed behavior. Any new code reading env vars for credentials or allowlists must use the profile-scoped secret scope.