Hermes Agent
CVE-2026-53869
HIGH
GHSA-4pqm-j46f-795x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable WebSocket with no auth (AV:N, PR:N), but DNS rebinding requires winning a TTL race (AC:H) and a victim browsing an attacker page (UI:R); PTY command injection yields full C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2Blast Radius
ecosystem impact- 1 pypi packages depend on hermes-agent (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.16.0.
DescriptionCVE.org
Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling attackers to exploit DNS rebinding and inject malicious commands or read terminal output.
AnalysisAI
DNS rebinding in NousResearch Hermes Agent prior to 0.16.0 allows remote attackers to reach privileged local WebSocket endpoints (/api/pty, /api/ws, /api/pub, /api/events) by tricking a victim's browser into resolving an attacker-controlled hostname to the agent's loopback address, bypassing Host and Origin checks. Because FastAPI HTTP middleware does not run on WebSocket upgrade requests, the validation layer is silently skipped, letting attackers inject commands into the PTY or stream terminal output. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Hermes Agent prior to 0.16.0 must be running and listening on a host reachable from the victim's browser (typical default: a loopback or LAN bind on a developer workstation), and the same user must load an attacker-controlled page in a browser on that host - DNS rebinding is the delivery mechanism, so UI in a browser context is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VA:H only) understates real impact and overstates ease: the description clearly says attackers can inject commands and read terminal output, which is high confidentiality and integrity impact, not just availability, and DNS rebinding always requires a victim to load attacker content in a browser (UI required) plus winning a TTL/rebind race (non-trivial complexity). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer running Hermes Agent on their laptop visits an attacker-controlled web page; the page's JavaScript opens a WebSocket to a hostname the attacker briefly resolves to a public IP (passing the same-origin policy), then rebinds the DNS record to 127.0.0.1 so subsequent WebSocket frames hit the local /api/pty endpoint. Because the Host/Origin middleware never fires on the upgrade, the connection is accepted and the attacker streams commands into the victim's shell or reads terminal output. … |
| Remediation | Vendor-released patch: Hermes Agent 0.16.0 (release tag v2026.6.5, https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5); the fix corresponds to upstream commit d9ec90585cf7616b5972e44cf8d92bb569fc3feb and PRs #30221 and #31685, which move Host/Origin validation into a WebSocket-aware dependency so it runs on upgrade requests. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and document all Hermes Agent deployments running versions prior to 0.16.0, including network location and access scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hermes Agent
View allRemote command injection in NousResearch hermes-agent allows unauthenticated attackers to execute arbitrary OS commands
Path traversal in NousResearch hermes-agent (all versions through 2026.5.16) exposes arbitrary server-side files via the
Path traversal in NousResearch hermes-agent through version 2026.4.16 allows remote unauthenticated attackers to bypass
Remote sandbox escape in NousResearch hermes-agent versions up to 2026.4.16 allows unauthenticated attackers to manipula
Remote code/prompt injection in NousResearch Hermes Agent through 0.12.0 stems from improper neutralization in the _comp
Remote injection in NousResearch Hermes Agent through version 2026.4.30 allows unauthenticated attackers to manipulate t
Code injection in NousResearch hermes-agent 2026.4.23 allows remote unauthenticated attackers to inject and execute arbi
Remote injection vulnerability in NousResearch hermes-agent versions up to 2026.4.23 enables unauthenticated attackers t
Uncontrolled resource consumption in NousResearch hermes-agent (all versions through 2026.4.30) allows remote unauthenti
Missing authorization in NousResearch hermes-agent versions up to 2026.4.16 allows remote attackers to bypass authentica
Information disclosure in NousResearch hermes-agent allows remote unauthenticated attackers to extract sensitive data vi
A vulnerability was identified in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today