Cairn
NousResearch/hermes-agent

Security: dangerous command approval bypass reports and fixes

Cluster 29159 · agent. Data as of

2 open items. Fix attempted, not merged.

The short answer

1open issue
1open PR
7items grouped
Known?
Yes. 7 related items grouped here, 2 issues already closed.
Fix event
No fix has been merged to main. 3 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
1 issue and 1 PR.

These issues and pull requests concern multiple reported bypass vulnerabilities where dangerous command approval guards are not enforced in certain execution contexts, including batch_runner.py, execute_code RPC threads, kanban workers, and sandbox terminal access. Proposed fixes involve restoring approval context, revoking terminal tool access in sandboxes, and enforcing guards across entry points.

Open issues1

  • Issue#55945[Security] Kanban worker subprocesses silently auto-approve dangerous commands (no approval-context flag set)

Open PRs1

  • PR#55946fix(security): close kanban worker auto-approve gap for dangerous commands

3 PRs closed without merging

From the close comments: superseded by another PR 1 · won't fix / by design 1 · other 1

  • #29307 fix(security): close Dangerous Command Approval Bypass in batch_runner.py (#29159, GHSA-7gp4-gfvg-4mpj) · won't fix / by design
  • #35167 fix(batch): set HERMES_CRON_SESSION to enforce approval guards · other
  • #52963 fix(security): enforce dangerous-command approval guard in batch_runner · superseded by another PR → #35167
Closed issues · 2
  • Closed#29159[Security tracking] Dangerous Command Approval Bypass in `batch_runner.py` via Insecure Default Fallback (GHSA-7gp4-gfvg-4mpj)
  • Closed#35164[Security] Dangerous Command Approval Bypass in `batch_runner.py` via Insecure Default Fallback
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.22: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Closed issues
2
Attempts
3 PRs closed without merging

For your agent

The same facts, typed.

cluster/29159.json
cluster/29159.md