Evidence record / hermes-agent
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-hermes-agent-desktop-simple-git-remediation-also-changes-forwarded-git-environment-variables
Desktop simple-git remediation also changes forwarded Git environment variables. Desktop source moves simple-git 3.36.0 to 4.0.2 and explicitly permits the SSH/askpass environment variables its Review pane needs for push. CVE-2026-102828 was published to the global advisory database on 2026-10-05, so this is remediation. An application accepting attacker-controlled trailer-command configuration and invoking interpret-trailers can run that command with Node-process privileges. Affected simple-git is >=3.15.0,<4.0.1. No matching Hermes exploit was established.
Channel: tagged-release. Half: both. Date: 2026-10-23.
Operator consequence: Audit custom Git/SSH environment assumptions and inspect the installed Desktop build. A fix in tagged Desktop source does not replace older standalone bundles; v0.22.5 explicitly did not update those installers.
Receipt
- https://github.com/NousResearch/hermes-agent/commit/14f2ca2bf40f012b0a90d7455cddaf692047b010
- https://github.com/NousResearch/hermes-agent/blob/v0.22.5/apps/desktop/package.json
- https://github.com/NousResearch/hermes-agent/blob/v0.22.5/apps/desktop/electron/git-review-ops.ts
- https://github.com/advisories/GHSA-x6jw-m9v5-85vh
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-hermes-agent-desktop-simple-git-remediation-also-changes-forwarded-git-environment-variables
Profile citations
- Hermes Agent / claim / desktop-git-environment-remediation
- Hermes Agent / posture / governance
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-hermes-agent-desktop-simple-git-remediation-also-changes-forwarded-git-environment-variablesgithub.com/NousResearch/hermes-agent/commit/14f2ca2bf40f012b0a90d7455cddaf692047b010tagged commit file2026-10-24-hermes-agent-desktop-simple-git-remediation-also-changes-forwarded-git-environment-variablesNousResearch/hermes-agent / apps/desktop/package.jsontagged commit file2026-10-24-hermes-agent-desktop-simple-git-remediation-also-changes-forwarded-git-environment-variablesNousResearch/hermes-agent / apps/desktop/electron/git-review-ops.tsofficial docs2026-10-24-hermes-agent-desktop-simple-git-remediation-also-changes-forwarded-git-environment-variablesgithub.com/advisories/GHSA-x6jw-m9v5-85vh
Versioned source: run artifact