CyberRota
← Ana sayfaya dön

CVE-2026-49959

HIGH · CVSS 8.8 EPSS %0.95 Public Exploit

Kaynak: NVD + CISA KEV + EPSS · Yayınlanma: 2026-06-09T17:17:49.370 · Çekilme zamanı: 2026-06-30T12:15:00.487621+00:00

CyberRota Yorumu

Uzaktan istismar edilebilir olabilir.

Public Exploit Sinyali

Bu CVE için açıklama veya referanslarda public exploit / PoC / GitHub / Metasploit sinyali tespit edildi.

Tespit Edilen Sinyaller
exploit remote code execution code execution
GitHub PoC Linkleri
github.com ↗ github.com ↗ github.com ↗

Not: Bu bağlantılar yalnızca güvenlik araştırması ve doğrulama amacıyla listelenmiştir.

CVE
CVE-2026-49959
Severity
HIGH
CVSS
8.8
EPSS
%0.95

Orijinal NVD Açıklaması

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in api/workspace_git.py through vectors such as core.fsmonitor during git status, protocol.ext.allow with ext:: remotes during git fetch, credential.helper, core.askPass, core.gitProxy, or inherited environment variables including GIT_SSH_COMMAND to achieve arbitrary command execution on the host running the application.