{"repo":"NousResearch/hermes-agent","public_id":"29159","display_label":"Security: dangerous command approval bypass reports and fixes","summary":"These issues and pull requests concern multiple reported bypass vulnerabilities where dangerous command approval guards are not enforced in certain execution contexts, including batch_runner.py, execute_code RPC threads, kanban workers, and sandbox terminal access. Proposed fixes involve restoring approval context, revoking terminal tool access in sandboxes, and enforcing guards across entry points.","subsystem":"agent","counts":{"members":7,"open_issues":1,"open_issues_distinct":1,"open_prs":1,"closed_issues":2,"merged_prs":0,"attempt_prs":4},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.22476190476190475},"fix_edges":[],"members":[{"kind":"issue","number":29159,"title":"[Security tracking] Dangerous Command Approval Bypass in `batch_runner.py` via Insecure Default Fallback (GHSA-7gp4-gfvg-4mpj)","url":null,"state":"closed"},{"kind":"issue","number":35164,"title":"[Security] Dangerous Command Approval Bypass in `batch_runner.py` via Insecure Default Fallback","url":null,"state":"closed"},{"kind":"issue","number":55945,"title":"[Security] Kanban worker subprocesses silently auto-approve dangerous commands (no approval-context flag set)","url":null,"state":"open"},{"kind":"pr","number":29307,"title":"fix(security): close Dangerous Command Approval Bypass in batch_runner.py (#29159, GHSA-7gp4-gfvg-4mpj)","url":null,"state":"closed","close_reason":{"category":"wontfix_bydesign","implication":"wontfix"},"merged":false},{"kind":"pr","number":35167,"title":"fix(batch): set HERMES_CRON_SESSION to enforce approval guards","url":null,"state":"closed","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true},{"kind":"pr","number":52963,"title":"fix(security): enforce dangerous-command approval guard in batch_runner","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#35167","number":35167}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":55946,"title":"fix(security): close kanban worker auto-approve gap for dangerous commands","url":null,"state":"open","close_reason":{"refs":[{"kind":"pr","value":"#55946","number":55946}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}