Hermes Agent CVE-2026-53869

Hermes Agent prior to 0.16.0 must be running and listening on a host reachable from the victim's browser (typical default: a loopback or LAN bind on a developer workstation), and the same user must load an attacker-controlled page in a browser on that host - DNS rebinding is the delivery mechanism, so UI in a browser context is required. Exploitation specifically targets the WebSocket endpoints /api/pty, /api/ws, /api/pub, and /api/events; the bug does not affect plain HTTP routes because FastAPI middleware still validates those. The attacker must also win a DNS-rebind race against browser/OS DNS caching, which adds practical complexity even though no Hermes-side authentication is needed.

The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VA:H only) understates real impact and overstates ease: the description clearly says attackers can inject commands and read terminal output, which is high confidentiality and integrity impact, not just availability, and DNS rebinding always requires a victim to load attacker content in a browser (UI required) plus winning a TTL/rebind race (non-trivial complexity). EPSS and KEV data were not provided, and no public PoC is referenced - exploitation is plausible but currently theoretical, with VulnCheck as the original reporter. Real-world risk is highest for developer/workstation deployments of Hermes Agent that bind to localhost and are reachable from any browser tab on the same host; server or headless installs without a browsing user are largely out of reach. Treat as a high-priority patch for desktop users, medium-priority elsewhere; the mismatch between the published 8.7 score and the actual impact metrics should be noted when triaging.

A developer running Hermes Agent on their laptop visits an attacker-controlled web page; the page's JavaScript opens a WebSocket to a hostname the attacker briefly resolves to a public IP (passing the same-origin policy), then rebinds the DNS record to 127.0.0.1 so subsequent WebSocket frames hit the local /api/pty endpoint. Because the Host/Origin middleware never fires on the upgrade, the connection is accepted and the attacker streams commands into the victim's shell or reads terminal output. No public PoC is referenced, but the technique is a well-documented variant of standard DNS rebinding against localhost services.