CVE-2026-58123

Name of the Vulnerable Software and Affected Versions Hermes WebUI versions prior to 0.51.788

Description An unauthenticated remote code execution issue allows remote attackers to execute arbitrary shell commands. This is achieved by accessing embedded terminal API endpoints without credentials through four sequential HTTP requests to create a session, attach a PTY shell, and write commands via the terminal input endpoint. This results in full command execution with the privileges of the server process user.

Recommendations Update Hermes WebUI to version 0.51.788 or later.