Is there a public PoC exploit available for CVE-2026-9351?

Yes, a public proof-of-concept exploit is available for CVE-2026-9351. Prioritise patching immediately. EPSS: 0.1%.

hermes-agent CVE-2026-9351

Q: What is the CVSS score of CVE-2026-9351?

CVE-2026-9351 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31565 MEDIUM

Path Traversal (CWE-22)

2026-05-24 VulDB

GHSA-hjf5-mqw9-9ph9

Path Traversal Hermes Agent

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 26, 2026 - 19:52 NVD

6.5 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

May 24, 2026 - 03:46 vuln.today

DescriptionCVE.org

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.16. This vulnerability affects the function _is_blocked_device of the file tools/file_tools.py of the component read_file Tool. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in NousResearch hermes-agent through version 2026.4.16 allows remote unauthenticated attackers to bypass path restrictions and modify or disrupt file operations via the read_file tool. The flaw exists in the _is_blocked_device function within tools/file_tools.py. Public exploit code is available (EPSS data not provided, but exploit confirmed). Vendor was notified but did not respond, suggesting no official patch exists at time of analysis.

Technical ContextAI

The vulnerability stems from improper validation in the _is_blocked_device function of the file_tools.py module, which is part of the read_file tool component. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) flaw. The function fails to adequately sanitize or validate file paths before processing, allowing attackers to use directory traversal sequences (e.g., '../') to access or manipulate files outside intended boundaries. The affected product is an AI agent framework (hermes-agent by NousResearch) that provides file system interaction capabilities, making path traversal particularly dangerous as it exposes the underlying system through the agent's file operations.

RemediationAI

No official vendor patch exists as NousResearch did not respond to vulnerability disclosure. Organizations must implement compensating controls: First, restrict network access to hermes-agent instances to trusted IP ranges only, preventing remote exploitation (trade-off: reduces agent accessibility for legitimate remote users). Second, implement application-level path validation by wrapping or modifying the read_file tool to enforce strict allowlists of permitted directories and reject any path containing traversal sequences like '../', './', or absolute paths (trade-off: may break legitimate use cases requiring broader file access). Third, run hermes-agent processes under least-privilege accounts with chroot jails or containerization to limit file system exposure even if path traversal succeeds (trade-off: increased deployment complexity). Fourth, monitor for suspicious file access patterns in application logs. Community forks or patches may emerge given the public exploit; monitor the GitHub repository at https://github.com/NousResearch/hermes-agent for community-driven fixes. Consider migrating to alternative AI agent frameworks with active security maintenance if vendor responsiveness remains absent.