Cairn
NousResearch/hermes-agent

PYTHONPATH injection vulnerability in code execution sandbox

Cluster 7071 · agent. Data as of

Nothing open on GitHub. Fix attempted, not merged.

The short answer

0open issues
0open PRs
5items grouped
Known?
Yes. 5 related items grouped here, 2 issues already closed.
Fix event
No fix has been merged to main. 3 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
Nothing open on GitHub.

Multiple reports and fixes address a security flaw where the code execution sandbox exposes internal modules and credentials via PYTHONPATH injection. The cluster covers the vulnerability reports, proposed patches, and a broader security fix batch.

Open issues0

No open issues.

Open PRs0

No open pull requests.

3 PRs closed without merging

From the close comments: done elsewhere 1 · duplicate 1 · other 1

  • #7136 fix(security): patch 5 open vulnerabilities · done elsewhere → #7071, #27303
  • #8050 fix(security): remove hermes root from code execution sandbox PYTHONPATH · other
  • #22195 fix(security): sandbox execute_code against PYTHONPATH import of hermes internals · duplicate → #8050, #8028
Closed issues · 2
  • Closed#7071[Bug] Hermes Agent Code Execution Sandbox Exposes Internal Modules via PYTHONPATH Injection — Configuration Secrets and Security Rules Leak
  • Closed#8028Security: PYTHONPATH injection in code_execution_tool sandbox allows credential theft
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.34: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Closed issues
2
Attempts
3 PRs closed without merging

For your agent

The same facts, typed.

cluster/7071.json
cluster/7071.md