Cairn

macOS symlink bypass of write deny list

NousResearch/hermes-agent · cluster 8031 · agent

Data as of

Nothing open on GitHub. Fix merged in #9008. Check it covers your case.

The short answer

0open issues
0open PRs
6items grouped
Known?
Yes. 6 related items grouped here, 2 issues already closed.
Fix event
A fix was merged to main in PR #9008. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this partially resolved, deciding PR #9008. That is separate from the fix event.
Still open
Nothing open on GitHub.

Multiple reports and proposed fixes for a security issue where the write deny list in file operations can be bypassed on macOS via symlinks (e.g., /private/etc). The cluster covers the vulnerability report and several candidate patches resolving symlinks before path checks.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #9008 fix(file_tools): block /private/etc writes on macOS symlink bypass

    merged to main

    files: tests/tools/test_file_write_safety.py, tools/file_tools.py

3 PRs closed without merging

From the close comments: merged via another change 2 · done elsewhere 1

  • #8051 fix(security): resolve symlinks before checking write deny list · done elsewhere → 9b36636, #8031
  • #8746 fix: block /private/etc writes on macOS (symlink bypass) · merged via another change → #9008
  • #8829 fix(file_tools): block sensitive paths before and after symlink resol… · merged via another change → #9008, #8746
Closed issues · 2
  • Closed#8031Security: write deny list in file_operations.py bypassed via symlinks
  • Closed#8734Path Write Protection Bypass via `/private/etc` Symlink
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.29: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Merged PRs
#9008
Closed issues
2
Attempts
3 PRs closed without merging
Fix link checked
13 Apr 2026. This confirmation is old and may be out of date (a revert or reopen would not have invalidated it here); re-verify.

For your agent

The same facts, typed.

cluster/8031.json
cluster/8031.md