PyPI/hermes CVE-2026-22798: medium 5.9, EPSS 0.17%
hermes's raw options logging may disclose secrets passed in via subcommand options argument
Action: Upgrade hermes to 0.9.1 or later.
pip install hermes==0.9.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.8.1 | 0.9.1 | - |
Fixed versions
| 0.9.1 |
Sources
- osv: PYSEC-2026-1449
- https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23
- https://nvd.nist.gov/vuln/detail/CVE-2026-22798
- https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1
- https://github.com/softwarepub/hermes/commit/90cb86acd026e7841f2539ae7a1b284a7f263514
- https://github.com/softwarepub/hermes
- https://pypi.org/project/hermes
- https://github.com/advisories/GHSA-jm5j-jfrm-hm23
CVE-2026-22798 · published · modified · JSON