Which versions of hermes-agent are affected by CVE-2026-9367?

CVE-2026-9367 is a critical remote command injection vulnerability in NousResearch hermes-agent that allows unauthenticated attackers to execute arbitrary operating system commands, potentially…

Is there a public PoC exploit available for CVE-2026-9367?

Yes, a public proof-of-concept exploit is available for CVE-2026-9367. Prioritise patching immediately. EPSS: 1.0%.

How to fix or mitigate CVE-2026-9367?

Within 24 hours: Inventory all systems running NousResearch hermes-agent and isolate affected instances from production networks if business-critical. Within 7 days: Evaluate alternative AI agent frameworks without known critical vulnerabilities; if hermes-agent is essential, implement the compensating controls listed below and document risk acceptance. Within 30 days: Complete migration to patched alternative or decommission hermes-agent components; conduct forensic analysis of logs for signs of exploitation dating back to deployment.

hermes-agent CVE-2026-9367

Q: What is the CVSS score of CVE-2026-9367?

CVE-2026-9367 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

EUVD-2026-31579 MEDIUM

OS Command Injection (CWE-78)

2026-05-24 VulDB

GHSA-h9mm-g7gx-9mx6

Command Injection Hermes Agent

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 26, 2026 - 19:52 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 19:52 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 24, 2026 - 09:30 vuln.today

DescriptionCVE.org

A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect_dangerous_command of the file tools/approval.py of the component terminal_tool. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote command injection in NousResearch hermes-agent allows unauthenticated attackers to execute arbitrary OS commands through the terminal_tool component's approval mechanism. The vulnerability affects all versions up to commit 5157f5427f19488b31c6fdebbacd15d798ce7f63 and has publicly available exploit code demonstrating the attack. The vendor has not responded to disclosure attempts, leaving users without an official patch.

Technical ContextAI

The vulnerability exists in the detect_dangerous_command function within tools/approval.py, which is part of the terminal_tool component. This function appears to implement security controls for command execution but fails to properly sanitize user input before passing it to the operating system. The root cause is CWE-78 (OS Command Injection), where untrusted input is incorporated into operating system commands without proper neutralization of special elements. Based on the CPE identifier, hermes-agent is a software tool by NousResearch, likely an AI agent framework with terminal execution capabilities.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor did not respond to early disclosure attempts according to the report. As an immediate mitigation, disable or restrict access to the terminal_tool component if possible, particularly the approval.py functionality. Organizations using hermes-agent should implement network segmentation to prevent untrusted access to systems running the agent, and monitor for suspicious command execution through the terminal_tool interface. Consider implementing web application firewall rules to filter potentially malicious inputs targeting the detect_dangerous_command function. Given the lack of vendor support, evaluate alternative AI agent frameworks with active security maintenance.