Vulnerability Description
hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens (e.g., via hermes deposit -O invenio_rdm.auth_token SECRET), these are written to the log file in plain text, making them available to whoever can access the log file. This vulnerability is fixed in 0.9.1.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Software-Metadata.Pub | Hermes | >= 0.8.1, < 0.9.1 |
Related Weaknesses (CWE)
References
- https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4Patch
- https://github.com/softwarepub/hermes/commit/90cb86acd026e7841f2539ae7a1b284a7f2Patch
- https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23PatchVendor Advisory
FAQ
What is CVE-2026-22798?
CVE-2026-22798 is a vulnerability with a CVSS score of 5.9 (MEDIUM). hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. T...
How severe is CVE-2026-22798?
CVE-2026-22798 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-22798?
Check the references section above for vendor advisories and patch information. Affected products include: Software-Metadata.Pub Hermes.