CVE-2026-49958

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.303

Description A time-of-check time-of-use (TOCTOU) race condition exists in the git discard() function within the api/workspace git.py file. This occurs when a validated path component is replaced with a symlink—a special file that points to another location—after the safe resolve ws() validation step but before the Path.unlink() or shutil.rmtree() deletion calls. This allows an attacker to delete arbitrary files outside the configured workspace boundary by forcing the delete operation to follow the symlink to an external directory.

Recommendations Update Hermes WebUI to version 0.51.303 or later.