hermes-agent CVE-2026-9351

Remote unauthenticated exploitation against default configurations of hermes-agent. The CVSS vector (PR:N/UI:N) confirms no authentication or user interaction is required. The specific condition is that the read_file tool component must be enabled and accessible to network requests, which is the default configuration for hermes-agent installations intended to provide file system capabilities. No special deployment modes or non-default settings are required. The vulnerability is limited by the implementation details of _is_blocked_device and the specific operations permitted through the read_file tool, which appear to restrict the impact to integrity and availability (CVSS I:L/A:L) rather than allowing full confidentiality breach, suggesting some implicit constraints on exploitable file operations even after path traversal succeeds.

The CVSS base score of 6.5 (Medium) reflects network-based exploitation (AV:N) with low complexity (AC:L) requiring no privileges (PR:N) or user interaction (UI:N), but with scope limited to integrity and availability impacts (I:L/A:L) rather than confidentiality breach. The temporal metrics show proof-of-concept exploit exists (E:P) with no official fix (RL:X), elevating real-world risk. Public exploit availability on GitHub significantly lowers the barrier to exploitation. However, the lack of confidentiality impact (C:N) and the limitation to low integrity/availability damage suggests the path traversal may be constrained to specific file operations rather than full arbitrary file read/write. The vendor's non-responsiveness is a critical red flag indicating no patch is forthcoming through official channels. Real-world priority is elevated by the network attack vector and public exploit, but tempered by the limited impact scope. Organizations using hermes-agent for file operations should treat this as high priority; those using it in isolated environments or without file system access can deprioritize.

An attacker identifies an internet-exposed hermes-agent instance and accesses its read_file tool interface. Using the public exploit code from GitHub (https://gist.github.com/YLChen-007/1d1aeff404cb88e06ec2fb3377f49fef), they craft file path requests containing directory traversal sequences to bypass the _is_blocked_device validation. This allows manipulation of files outside the intended agent workspace, potentially modifying configuration files or disrupting file-based operations, resulting in integrity violations or service availability degradation.