Is there a public PoC exploit available for CVE-2026-7397?

Yes, a public proof-of-concept exploit is available for CVE-2026-7397. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-7397?

Yes, a patch is available for CVE-2026-7397. Update the affected software to the latest version immediately.

hermes-agent CVE-2026-7397

Q: What is the CVSS score of CVE-2026-7397?

CVE-2026-7397 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26273 LOW

UNIX Symbolic Link (Symlink) Following (CWE-61)

2026-04-29 VulDB

Information Disclosure Hermes Agent Nousresearch

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

Local-only vector with low-privilege requirement; integrity and availability both low as write access to sensitive files may corrupt them but does not enable code execution.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 01:35 vuln.today

Analysis Generated

Jul 24, 2026 - 01:35 vuln.today

PoC Detected

Apr 29, 2026 - 21:16 vuln.today

Public exploit code

Severity Changed

Apr 29, 2026 - 19:22 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 19:22 NVD

4.4 (MEDIUM) 1.9 (LOW)

EUVD ID Assigned

Apr 29, 2026 - 18:30 euvd

EUVD-2026-26273

Patch released

Apr 29, 2026 - 18:30 nvd

Patch available

CVE Published

Apr 29, 2026 - 18:00 nvd

LOW 1.9

DescriptionCVE.org

A security flaw has been discovered in NousResearch hermes-agent 0.8.0. This affects the function _check_sensitive_path of the file tools/file_tools.py. The manipulation results in symlink following. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.9.0 is able to mitigate this issue. The patch is identified as 311dac197145e19e07df68feba2cd55d896a3cd1. Upgrading the affected component is recommended.

AnalysisAI

Symlink following in NousResearch hermes-agent 0.8.0 allows local low-privileged users to bypass sensitive filesystem path protections and write to restricted system files. The _check_sensitive_path function in tools/file_tools.py validated only the fully-resolved real path, not the original expanded path, enabling bypass on platforms where system directories are themselves symlinks (e.g., macOS /etc → /private/etc). A publicly available PoC exists; no confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 score of 1.9 with EPSS at the 2nd percentile indicates low real-world risk.

Technical ContextAI

CWE-61 (UNIX Symbolic Link Following) describes the root cause: the function _check_sensitive_path in tools/file_tools.py called os.path.realpath(os.path.expanduser(filepath)) to resolve the input path before checking it against _SENSITIVE_PATH_PREFIXES and _SENSITIVE_EXACT_PATHS. On macOS, /etc is itself a symlink to /private/etc, so a path like /etc/hosts resolves to /private/etc/hosts. If the blocklist contained /etc/ but not /private/etc/, the resolved path silently bypassed the check. Additionally, the fallback in the except block assigned the unresolved original filepath (not even the expanded form) to resolved, creating a second bypass window if os.path.realpath() threw. The fix (commit 311dac197145e19e07df68feba2cd55d896a3cd1) checks both the expanded and resolved forms of the path against all sensitive prefix and exact-match lists, closing both gaps. Affected product per CPE: cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*, version 0.8.0 confirmed by EUVD (EUVD-2026-26273).

RemediationAI

Upgrade to hermes-agent 0.9.0 (released as tag v2026.4.13), which includes the fix via commit 311dac197145e19e07df68feba2cd55d896a3cd1 (https://github.com/NousResearch/hermes-agent/commit/311dac197145e19e07df68feba2cd55d896a3cd1). The patched release is available at https://github.com/NousResearch/hermes-agent/releases/tag/v2026.4.13. If an immediate upgrade is not feasible, restrict local system access to hermes-agent's process to only trusted users, as the attack requires an existing local session with low privileges. On macOS deployments specifically, administrators should audit whether _SENSITIVE_PATH_PREFIXES in the current installation includes both /etc/ and /private/etc/ as a temporary compensating control, noting this is a manual workaround that does not address the underlying path resolution flaw and may be bypassed by other symlink configurations.