Issue Station
Sign In
Tools hereToolbox

hermes - 💡(How to fix) Fix [Security tracking] Hermes Agent API Server allows forged todo-tool history hydration that can exhaust session context (GHSA-5g4g-6jrg-mw3g)

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
RAW_BUFFERClick to expand / collapse

This issue tracks a private GitHub Security Advisory that is currently in triage.

  • Advisory: GHSA-5g4g-6jrg-mw3g
  • Status: triage
  • Summary: Hermes Agent API Server allows forged todo-tool history hydration that can exhaust session context
  • Advisory updated: 2026-05-07T11:16:28Z

Technical details, proof-of-concept material, affected code paths, and exploitability notes are intentionally omitted from this public issue while the advisory remains under triage. Please coordinate remediation and disclosure in the private Security Advisory thread.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING