Cairn
NousResearch/hermes-agent

key_cmd shell injection hardening via argv fixes

Cluster 98831 · agent. Data as of

2 open items. Fix attempted, not merged.

The short answer

1open issue
1open PR
5items grouped
Known?
Yes. 5 related items grouped here, 0 issues already closed.
Fix event
No fix has been merged to main. 3 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
1 issue and 1 PR.

These items address a security concern about key_cmd executing with implicit shell invocation, with fixes focused on switching to shell=False and native argv to reduce injection risk. Multiple related fix attempts and a tracking issue are grouped here.

Open issues1

  • Issue#98831[P0] key_cmd implicit shell + wrapper re-entry — trusted-operator hardening (hostile-writer allowlist tracked in #98910)

Open PRs1

  • PR#98913fix(security): harden key_cmd argv — trusted-operator hardening beyond 97217 (Fixes #98831, tracks #98910)

3 PRs closed without merging

From the close comments: partial fix 1 · superseded by another PR 1 · won't fix / by design 1

  • #98837 fix(security): harden key_cmd argv — trusted-operator hardening beyond 97217 (Fixes #98831, tracks #98910) · won't fix / by design → #97217, #98831
  • #103052 fix(security): prevent shell injection in key_cmd via shell=False on POSIX (#98831) · partial fix → d93ce5f, 13e72fb, #98831, #98910, #97217, #98913
  • #103695 fix(security): key_cmd runs as native argv - no shell, no wrappers (#98831) · superseded by another PR → #98913
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.40: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Closed issues
0
Attempts
3 PRs closed without merging

For your agent

The same facts, typed.

cluster/98831.json
cluster/98831.md