hermes-agent CVE-2026-7396

The WeCom (WeChat Work) platform adapter must be actively deployed and its endpoint reachable over the network - deployments that do not use the WeChat Work integration and have not started that adapter are not affected. No authentication is required per the CVSS PR:N metric. However, SSVC's 'Automatable: no' designation indicates that exploitation is not trivially scriptable at scale, likely because attackers must first discover the specific WeCom endpoint path and identify the correct vulnerable parameter within wecom.py - these are not exposed by default in a standardized way. Impact is bounded to files readable by the server process (VC:L); the CVSS VI:N/VA:N metrics confirm that write access and denial-of-service are not achievable through this vector. Non-default deployment of the WeCom integration and the targeting complexity described by SSVC are the primary limiting factors for defenders assessing realistic exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) yields a 5.5 score, reflecting unauthenticated, low-complexity network exploitation - superficially alarming. However, three signals substantially reduce real-world priority: EPSS at 0.05% (15th percentile) places this well below typical active-exploitation thresholds; SSVC designates it 'Automatable: no', which is in tension with AC:L/PR:N and suggests hidden targeting complexity not fully encoded in the CVSS vector (possibly endpoint discovery or parameter structure requirements); and impact is confined to VC:L (partial confidentiality read) with VI:N/VA:N, ruling out data manipulation or service disruption. No CISA KEV listing has been confirmed. The public POC warrants attention for organizations actively running the WeCom adapter, but mass exploitation is unlikely given the niche deployment footprint and non-automatability signal.

An unauthenticated attacker who has identified a publicly exposed hermes-agent WeCom adapter endpoint sends a crafted HTTP request containing path traversal sequences (e.g., ../../../../etc/passwd or equivalent URL-encoded forms) in a filename or path parameter processed by gateway/platforms/wecom.py. The adapter constructs a file path from this input without stripping traversal sequences, causing the server to return the contents of an arbitrary file readable by the hermes-agent process. A public proof-of-concept referenced at https://github.com/NousResearch/hermes-agent/issues/8733 and https://github.com/bugmaker2/hermes-agent/issues/29 demonstrates this technique.