VULNERABILITY INTELLIGENCE

CVE-2026-22798

CVSS score5.9 MEDIUM
EPSS probability0.17%
CISA KEVNot currently listed
Published2026-01-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

Description

hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens (e.g., via hermes deposit -O invenio_rdm.auth_token SECRET), these are written to the log file in plain text, making them available to whoever can access the log file. This vulnerability is fixed in 0.9.1.

Weakness classification

  • security-advisories@github.com: CWE-532

Primary references