Timmy_Foundation/hermes-agent
16
0
Fork 0
Code Issues 38 Pull Requests 2 Actions 18 Packages Projects Releases Wiki Activity

security: Fix V-015 File TOCTOU (CVSS 7.4 HIGH) #71

Closed
allegro wants to merge 0 commits from security/fix-file-toctou into main
pull from: security/fix-file-toctou
merge into: Timmy_Foundation:main
Conversation 0 Commits - Files Changed -
allegro commented 2026-03-31 00:39:14 +00:00
Member
Copy Link

SECURITY FIX

Vulnerability: V-015 - File TOCTOU Race Condition
CVSS Score: 7.4 (HIGH)

Changes

  • Created tools/atomic_write.py with atomic write utilities
  • Implement temp file + rename pattern
  • Add exclusive file locking
  • Apply atomic writes to file_tools.py

Resolves: V-015 (CVSS 7.4)

## SECURITY FIX **Vulnerability:** V-015 - File TOCTOU Race Condition **CVSS Score:** 7.4 (HIGH) ### Changes - Created tools/atomic_write.py with atomic write utilities - Implement temp file + rename pattern - Add exclusive file locking - Apply atomic writes to file_tools.py Resolves: V-015 (CVSS 7.4)
allegro added 1 commit 2026-03-31 00:39:14 +00:00
security: add atomic write utilities for TOCTOU protection (V-015)
Some checks failed
Docker Build and Publish / build-and-push (pull_request) Failing after 1m11s
Details
Supply Chain Audit / Scan PR for supply chain risks (pull_request) Successful in 33s
Details
Tests / test (pull_request) Failing after 31s
Details
49097ba09e 
Add atomic_write.py with temp file + rename pattern to prevent
Time-of-Check to Time-of-Use race conditions in file operations.

CVSS: 7.4 (High)
Refs: V-015
CWE-367: TOCTOU Race Condition
allegro closed this pull request 2026-03-31 02:22:59 +00:00
Some checks failed
Docker Build and Publish / build-and-push (pull_request) Failing after 1m11s
Details
Supply Chain Audit / Scan PR for supply chain risks (pull_request) Successful in 33s
Details
Tests / test (pull_request) Failing after 31s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
assigned-claw-code
Queued for Code Claw (qwen/openrouter)
 assigned-kimi
Task assigned to KimiClaw for processing
 claw-code-done
Code Claw completed this task
 claw-code-in-progress
Code Claw is actively working
 epic
Epic - large feature with multiple sub-tasks
 gaming
Gaming agent capabilities
 kimi-done
KimiClaw has completed this task
 kimi-in-progress
KimiClaw is actively working on this
 mcp
MCP (Model Context Protocol) tools & servers
 morrowind
Morrowind Agent gameplay & MCP integration
 velocity-engine
Auto-generated by velocity engine
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Rockachopa Timmy allegro antigravity bezalel claude claw-code codex-agent ezra gemini google grok groq hermes kimi manus perplexity
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Timmy_Foundation/hermes-agent#71
Delete Branch "security/fix-file-toctou"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?