Which versions of hermes-agent are affected by CVE-2026-9368?

NousResearch hermes-agent versions 2026.4.16 and earlier contain a remote sandbox escape vulnerability that allows unauthenticated attackers to manipulate environment variables and compromise the…. A patch is available.

Is there a public PoC exploit available for CVE-2026-9368?

Yes, a public proof-of-concept exploit is available for CVE-2026-9368. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-9368?

Within 24 hours: Inventory all hermes-agent deployments and document versions in use; isolate affected systems from production networks if version 2026.4.16 or earlier is confirmed. Within 7 days: Implement network segmentation to restrict hermes-agent communication and monitor environment variable access logs; contact NousResearch for patch status or migration guidance. Within 30 days: Evaluate alternative agent frameworks or deploy hermes-agent only in air-gapped environments; establish process to discontinue hermes-agent if vendor does not release a patched version.

hermes-agent CVE-2026-9368

Q: What is the CVSS score of CVE-2026-9368?

CVE-2026-9368 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31582 MEDIUM

Privilege Issues (CWE-265)

2026-05-24 VulDB

GHSA-wm96-9gfh-vvgq

Information Disclosure Hermes Agent

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 26, 2026 - 19:52 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 19:52 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 24, 2026 - 09:30 vuln.today

DescriptionCVE.org

A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Environment Variable Handler. Such manipulation leads to sandbox issue. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote sandbox escape in NousResearch hermes-agent versions up to 2026.4.16 allows unauthenticated attackers to manipulate environment variables through the code execution tool, potentially breaking out of the intended security sandbox. The vulnerability has publicly available exploit code and the vendor has not responded to disclosure attempts, leaving systems unpatched.

Technical ContextAI

The vulnerability affects the execute_code function in tools/code_execution_tool.py, specifically in the Environment Variable Handler component. Based on CWE-265 (Privilege/Sandbox Issues), the root cause appears to be improper isolation or validation when handling environment variables during code execution. The hermes-agent appears to be a code execution or automation tool that implements sandboxing, but the sandbox can be bypassed through environment variable manipulation.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor was contacted but did not respond to the disclosure. Organizations should consider disabling or removing hermes-agent until a patch becomes available. If the tool must remain operational, implement network-level access controls to restrict who can reach the service, monitor for exploitation attempts targeting the code execution functionality, and consider running the service in an additional isolation layer such as a container or VM with restricted permissions. Review and restrict environment variable access within the deployment environment.