{"repo":"NousResearch/hermes-agent","public_id":"108346","display_label":"Profile name traversal vulnerability and RPC handling","summary":"These items concern path traversal risks when profile names are used in filesystem operations, plus related RPC parameter validation and profile lifecycle behavior in gateway routes. The fix involves rejecting traversal-shaped profile names at input.","subsystem":null,"counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":110212,"merged_at":"2026-09-13T22:45:58+00:00"},"resolution":{"state":"unresolved","by":null},"freshness":{"state":"verified","last_verified_at":"2026-09-13T22:45:58+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":90699,"pr_number":110212,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-13T22:45:58+00:00"},{"issue_number":107829,"pr_number":110212,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-13T22:45:58+00:00"},{"issue_number":108346,"pr_number":110212,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-09-13T22:45:58+00:00"},{"issue_number":109016,"pr_number":110212,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-09-13T22:45:58+00:00"}],"members":[{"kind":"issue","number":108346,"title":"[Bug]: profile param on gateway RPCs resolves traversal-shaped names as filesystem paths","url":null,"state":"closed"},{"kind":"pr","number":108348,"title":"fix(profiles): reject traversal-shaped profile names in get_profile_dir","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"a7254e2d4c17","number":0},{"kind":"commit","value":"2770f93064aa","number":0},{"kind":"commit","value":"4ad60ac475d8","number":0},{"kind":"pr","value":"#110212","number":110212},{"kind":"pr","value":"#89959","number":89959},{"kind":"pr","value":"#108346","number":108346},{"kind":"pr","value":"#90699","number":90699}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":110212,"title":"Multiplexed profile lifecycle: webhook routes bind to a profile, RPC profile params fail closed, deleted profile is a typed RPC error (#109016 #107829 #108346)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/profiles.py","hermes_cli/subcommands/webhook.py","hermes_cli/webhook.py","tests/hermes_cli/test_profiles.py","tests/hermes_cli/test_webhook_cli.py","tests/tui_gateway/test_profile_target_unavailable.py","tui_gateway/mcp_rpc_helpers.py","tui_gateway/methods_profiles.py","tui_gateway/methods_tools.py","tui_gateway/server.py","website/docs/reference/cli-commands.md","website/docs/user-guide/messaging/webhooks.md","website/docs/user-guide/multi-profile-gateways.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}