{"repo":"NousResearch/hermes-agent","public_id":"7089","display_label":"Twilio SMS webhook signature validation security issue","summary":"A reported vulnerability and multiple proposed fixes concern missing validation of the X-Twilio-Signature header on inbound SMS webhooks. The lack of validation was identified as enabling unauthenticated remote code execution.","subsystem":null,"counts":{"members":6,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":4},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":7933},"resolution":{"state":"resolved","by":"pr-7933"},"freshness":{"state":"stale","last_verified_at":"2026-04-11T21:05:39+00:00","is_stale":true},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.3333333333333333},"fix_edges":[{"issue_number":7089,"pr_number":7933,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true}],"members":[{"kind":"issue","number":7089,"title":"[Bug]: Unauthenticated Remote Code Execution via SMS Webhook — Missing Twilio Signature Validation","url":null,"state":"closed"},{"kind":"pr","number":7121,"title":"fix(sms): validate X-Twilio-Signature on inbound webhooks","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#7933","number":7933}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":7162,"title":"fix(security): validate Twilio signature in SMS webhook (RCE fix for #7089)","url":null,"state":"closed","close_reason":{"category":"silent_close","implication":"active"},"merged":false},{"kind":"pr","number":7223,"title":"fix(security): validate Twilio signature in SMS webhook (RCE fix for #7089)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#7933","number":7933}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":7904,"title":"fix(security): add Twilio webhook signature validation to prevent unauthenticated RCE","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#7933","number":7933}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":7933,"title":"fix(security): add Twilio webhook signature validation (SMS RCE fix)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["gateway/platforms/sms.py","tests/gateway/test_sms.py","website/docs/reference/environment-variables.md","website/docs/user-guide/messaging/sms.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}