Is there a public PoC exploit available for CVE-2026-9354?

Yes, a public proof-of-concept exploit is available for CVE-2026-9354. Prioritise patching immediately. EPSS: 0.0%.

Hermes Agent CVE-2026-9354

Q: What is the CVSS score of CVE-2026-9354?

CVE-2026-9354 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31566 MEDIUM

Improper Encoding or Escaping of Output (CWE-116)

2026-05-24 VulDB

GHSA-7pxq-5rjc-m2wr

Information Disclosure Mattermost

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 26, 2026 - 19:52 NVD

6.5 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

May 24, 2026 - 05:16 vuln.today

DescriptionCVE.org

A vulnerability was detected in NousResearch hermes-agent up to 2026.4.16. The affected element is an unknown function of the component Slack Agent/Mattermost Agent. The manipulation of the argument format_message results in escaping of output. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers to manipulate message formatting in Slack and Mattermost integrations, potentially leading to information disclosure and service disruption. The vulnerability is exploitable via crafted format_message arguments with low attack complexity and requires no user interaction. Public exploit code is available via GitHub Gist. The vendor did not respond to early disclosure attempts, and no patch availability is documented.

Technical ContextAI

The vulnerability affects the Hermes Agent messaging integration layer, specifically the format_message argument handling in Slack Agent and Mattermost Agent components. This is classified as CWE-116 (Improper Encoding or Escaping of Output), indicating the agent fails to properly sanitize or escape output when formatting messages for chat platforms. The affected component (cpe:2.3:a:nousresearch:hermes-agent) processes user-controlled input and renders it to messaging platforms without adequate output encoding. This class of vulnerability typically allows attackers to inject control characters, escape sequences, or formatting directives that bypass intended message boundaries, potentially enabling data exfiltration through crafted responses or disruption of message integrity. The network attack vector suggests the vulnerability can be triggered through API endpoints or webhook handlers that process external message formatting requests.

RemediationAI

No vendor-released patch is documented at time of analysis, as the vendor did not respond to early disclosure. Until an official fix becomes available, implement the following compensating controls: Restrict network access to Hermes Agent API endpoints and webhook handlers to trusted IP ranges only, blocking untrusted external access to format_message functionality. Deploy a reverse proxy or web application firewall to inspect and sanitize format_message parameter inputs, blocking payloads containing escape sequences, control characters, or formatting directives outside expected schemas - note this may break legitimate advanced formatting features if used. Disable Slack Agent and Mattermost Agent components entirely if not operationally required, eliminating the attack surface - impact includes loss of chat platform integration capabilities. Implement strict input validation on all external message sources before passing to format_message, though effectiveness depends on understanding the specific escaping flaw. Monitor VulDB (https://vuldb.com/vuln/365317) and NousResearch project channels for vendor response or community patches. Consider migrating to alternative agent frameworks with active security maintenance if vendor remains unresponsive. Review audit logs for suspicious format_message API calls showing manipulation attempts, focusing on unusual character patterns or formatting directives.