Hermes Agent CVE-2026-9354

Exploitation requires that the target deployment has either Slack Agent or Mattermost Agent components enabled and accessible via network. The vulnerability is exploitable against default configurations of Hermes Agent versions up to 2026.4.16 with no special configuration changes needed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation with low attack complexity and no user interaction required. Exploitation is NOT limited by authentication barriers, non-standard deployments, or user-triggered actions. However, actual impact depends on how the format_message functionality is exposed - deployments with network-accessible API endpoints or webhooks for message formatting are directly exploitable, while air-gapped or strictly internal-only deployments face reduced risk. The attack requires the agent to process attacker-controlled input through the vulnerable format_message argument handler.

The vulnerability presents moderate real-world risk with mixed signals. CVSS 6.5 (Medium) reflects network-based exploitation with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N), but impact is limited to low integrity and availability (I:L/A:L) with no confidentiality impact (C:N). The CVSS temporal metrics show proof-of-concept exploit exists (E:P) with no remediation level documented (RL:X) and reasonable report confidence (RC:R). Public exploit availability on GitHub significantly lowers the barrier to exploitation. However, EPSS data is not available to assess observed exploitation probability, and the vulnerability is not listed in CISA KEV, suggesting no widespread active exploitation campaigns detected. The scope is unchanged (S:U), limiting blast radius to the vulnerable component itself. Critical missing data: EPSS exploitation probability, SSVC exploitation status, patch availability from vendor. The vendor's non-responsiveness to disclosure raises concerns about ongoing security support. Real-world risk depends heavily on deployment context - organizations using Hermes Agent for Slack/Mattermost integrations in production environments face moderate risk due to the network attack vector and public exploit, while the limited CVSS impact scores suggest exploitation may require chaining with other vulnerabilities for significant damage. Without vendor engagement or patch timeline, this should be prioritized for compensating controls rather than waiting for an official fix.

An unauthenticated remote attacker crafts a malicious HTTP request to a Hermes Agent API endpoint or webhook, embedding specially crafted format_message parameters with improper escape sequences. When the agent processes this input for Slack or Mattermost message rendering, the unescaped output manipulates message formatting to leak sensitive information from other chat contexts or corrupts message integrity, potentially causing service disruption or information disclosure to unauthorized parties. The public GitHub Gist exploit (https://gist.github.com/YLChen-007/e90fb38ac03284176bae49898a3a46a4) provides ready-to-use attack code requiring minimal technical sophistication.