1282 matches found
GHSA-JM5J-JFRM-HM23 hermes's raw options logging may disclose secrets passed in via subcommand options argument
Thanks, @thunze for reporting this! hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form since https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1 in:...
hermes's raw options logging may disclose secrets passed in via subcommand options argument
Thanks, @thunze for reporting this! hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form since https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1 in:...
Insertion of Sensitive Information into Log File
Overview hermes is a Workflow to publish research software with rich metadata Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the -O options argument handling process. An attacker can obtain sensitive information by accessing log files that...
CVE-2026-22798
hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens e.g., via...
CVE-2026-22798
The CVE-2026-22798 issue affects the Hermes workflow tool. It concerns logging of arbitrary options passed via the -O argument, which could cause sensitive data (e.g., API tokens) to be written to log files in plaintext. This behavior occurs in Hermes releases from 0.8.1 up to before 0.9.1. Impac...
CVE-2026-22798 hermes's raw options logging may disclose secrets passed in via subcommand options argument
hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens e.g., via...
CVE-2026-22798 hermes's raw options logging may disclose secrets passed in via subcommand options argument
hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens e.g., via...
CVE-2026-22798 hermes's raw options logging may disclose secrets passed in via subcommand options argument
hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens e.g., via...
PT-2026-2310
Name of the Vulnerable Software and Affected Versions hermes versions 0.8.1 through 0.9.0 Description hermes, a software publication automation workflow, exhibits a flaw where subcommands accept arbitrary options through the -O argument. Providing sensitive data, such as API tokens e.g., via herm...
hermes 日志信息泄露漏洞
Hermes is a workflow platform open-sourced by Automated Software Metadata Publication. A log information disclosure vulnerability exists in hermes version 0.8.1 through versions prior to 0.9.1, which stems from the hermes subcommand logging arbitrary options in raw form under the -O parameter,...
CVE-2023-25933
A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary code via untrusted JavaScript. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, mos...
CVE-2022-35289
A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of...
EUVD-2025-176921
Malicious code in publish-postcss-loader-achernar-hermes npm...
Malicious code in mesosphere-chai-hermes-eris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3a859d8b89079691e1fa4081212caa22fbc584c0379ef009eee6eb1c9d5ba1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-177575
Malicious code in node-config-lynx-cressida-hermes npm...
EUVD-2025-175555
Malicious code in whitedwarf-tectonic-izar-hermes npm...
EUVD-2025-179986
Malicious code in borealis-hermes-bellatrix-geochronology npm...
Malicious code in grus-nodemon-rehype-hermes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6d559410a1d7d46410b0043f04df13062a94d3ab8a1f955226d05167489046f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...