CVE-2026-22798

Katalog CVE

CVSS 5.0 · Medium EPSS 0,17%

Kerentanan Insertion of Sensitive Information into Log File pada software-metadata.pub hermes. Skor CVSS 3.1 5.0 (Medium) menurut NVD.

Deskripsi (NVD)

hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens (e.g., via hermes deposit -O invenio_rdm.auth_token SECRET), these are written to the log file in plain text, making them available to whoever can access the log file. This vulnerability is fixed in 0.9.1.

Rincian

Terbit di NVD

12 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.0 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 6,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23 patch · advisory vendor
• https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1 patch
• https://github.com/softwarepub/hermes/commit/90cb86acd026e7841f2539ae7a1b284a7f263514 patch