CVE-2026-22798: hermes Package Sensitive Data Exposure via Raw Options Logging
Summary
CVE-2026-22798: hermes's raw options logging may disclose secrets passed in via subcommand options argument. Affects hermes versions >= 0.8.1, < 0.9.1. Fixed in 0.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hermes package is a command-line tool designed for managing various tasks related to software deployment and operations. It allows users to execute subcommands with various options, enhancing its flexibility and usability. However, the package has a vulnerability that exposes sensitive information due to the way it logs raw options passed via the command line.
Vulnerability Detail
The vulnerability arises from the logging mechanism of the hermes package, which records subcommand options in their raw form. Since the introduction of this logging behavior, sensitive data such as API tokens can be inadvertently logged in plain text. This poses a risk to users, especially in environments where log files may be accessed by unauthorized individuals. The issue primarily affects local users on shared computers and CI environments where logs are accessible to others, potentially leading to unauthorized access to sensitive credentials.
How To Fix
Latest published version: 0.10.0 as of 23 Oct 2026
pip install --upgrade "hermes==0.10.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.1
This is the first release that contains the fix.
pip install --upgrade "hermes==0.9.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid passing sensitive information directly via the -O option until they can upgrade to hermes version 0.9.1 or later. Instead, consider using environment variables or configuration files to manage sensitive data securely.
Conclusion
The hermes package has a vulnerability that exposes sensitive information through its logging mechanism. Users are advised to upgrade to version 0.9.1 or later to mitigate this risk. Until then, alternative methods for handling sensitive data should be employed.
See every vulnerability recorded for hermes →
FAQ
CVE-2026-22798 is a vulnerability in the hermes package that allows sensitive data to be logged in plain text, potentially exposing it to unauthorized users.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, avoid using the -O option with sensitive data and consider using environment variables or secure configuration methods.
The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
More information about the hermes package can be found on its GitHub repository or the official documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for hermes.
