EUVD-2026-31582
GHSA-wm96-9gfh-vvgq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessNetwork scan for hermes-agent
-
DeliverySend crafted environment variables
-
ExploitBypass sandbox restrictions
-
ExecutionExecute arbitrary code
-
ImpactEstablish persistence
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of hermes-agent. The vulnerability requires only network access to the hermes-agent service and affects the code execution functionality in tools/code_execution_tool.py. Versions up to 2026.4.16 are confirmed vulnerable. |
| Impact | The CVSS 3.1 score of 7.3 indicates high severity with network-based, low complexity, no privilege/no interaction required exploitation (AV:N/AC:L/PR:N/UI:N). The EPSS data is not provided, but the exploit code maturity is marked as 'Proof-of-Concept' (E:P) in the CVSS vector. While not listed in CISA KEV, the availability of public exploit code significantly increases real-world risk. The remediation level is marked as unavailable (RL:X) and report confidence as reasonable (RC:R), indicating no vendor fix exists. This combination of remote exploitability, public POC, and no vendor response makes this a priority for organizations using hermes-agent. |
| Exploit ScenarioDerived | An attacker sends a crafted request to the hermes-agent service containing malicious environment variable values. The execute_code function processes these variables without proper sanitization, allowing the attacker to escape the intended sandbox and execute arbitrary commands with the privileges of the hermes-agent process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 24, 2026
Remote sandbox escape in NousResearch hermes-agent versions up to 2026.4.16 allows unauthenticated attackers to manipulate environment variables through the code execution tool, potentially breaking out of the intended security sandbox. The vulnerability has publicly available exploit code and the vendor has not responded to disclosure attempts, leaving systems unpatched.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor was contacted but did not respond to the disclosure. Organizations should consider disabling or removing hermes-agent until a patch becomes available. If the tool must remain operational, implement network-level access controls to restrict who can reach the service, monitor for exploitation attempts targeting the code execution functionality, and consider running the service in an additional isolation layer such as a container or VM with restricted permissions. Review and restrict environment variable access within the deployment environment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the execute_code function in tools/code_execution_tool.py, specifically in the Environment Variable Handler component. Based on CWE-265 (Privilege/Sandbox Issues), the root cause appears to be improper isolation or validation when handling environment variables during code execution. The hermes-agent appears to be a code execution or automation tool that implements sandboxing, but the sandbox can be bypassed through environment variable manipulation.
Know when Hermes Agent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Environment Variable Handler. Such manipulation leads to sandbox issue. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
NousResearch hermes-agent versions 2026.4.16 and earlier contain a remote sandbox escape vulnerability that allows unauthenticated attackers to manipulate environment variables and compromise the isolation of agent execution environments. This exposes organizations using hermes-agent to arbitrary code execution and potential lateral movement within connected systems, with publicly available exploit code increasing immediate risk.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict hermes-agent deployment to isolated, non-critical environments with no access to sensitive data or production systems; (2) Implement strict network egress filtering and monitor all outbound connections; (3) Disable or remove the code execution tool feature if functionally possible; (4) Apply OS-level sandboxing (containers with minimal privileges, restricted syscalls) to further isolate the agent process; (5) Enable comprehensive logging and alerting on environment variable modifications and code execution attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Hermes Agent
View allRemote code execution in NousResearch Hermes Agent 0.18.2-0.21.0 allows an unauthenticated attacker to execute arbitrary
Remote command injection in NousResearch hermes-agent allows unauthenticated attackers to execute arbitrary OS commands
Path traversal in NousResearch hermes-agent (all versions through 2026.5.16) exposes arbitrary server-side files via the
Path traversal in NousResearch hermes-agent through version 2026.4.16 allows remote unauthenticated attackers to bypass
Path traversal in NousResearch hermes-agent 0.8.0 exposes arbitrary server-side files to unauthenticated remote attacker
Remote code/prompt injection in NousResearch Hermes Agent through 0.12.0 stems from improper neutralization in the _comp
Remote injection in NousResearch Hermes Agent through version 2026.4.30 allows unauthenticated attackers to manipulate t
Code injection in NousResearch hermes-agent 2026.4.23 allows remote unauthenticated attackers to inject and execute arbi
Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers t
Remote injection vulnerability in NousResearch hermes-agent versions up to 2026.4.23 enables unauthenticated attackers t
Uncontrolled resource consumption in NousResearch hermes-agent (all versions through 2026.4.30) allows remote unauthenti
Missing authorization in NousResearch hermes-agent versions up to 2026.4.16 allows remote attackers to bypass authentica
Exploit-DB