hermes-agent EUVD-2026-41794

Q: What is the CVSS score of EUVD-2026-41794?

EUVD-2026-41794 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-14783 LOW

Path Traversal (CWE-22)

2026-07-06 cna@vuldb.com

GHSA-xq87-v97r-jw5g

Path Traversal

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible with low complexity, but PR:L required per CVSS 4.0 source; impact limited to low confidentiality read - no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 00:27 vuln.today

DescriptionCVE.org

A vulnerability was determined in NousResearch hermes-agent 2026.5.29.2. The impacted element is the function skill_view of the file tools/skills_tool.py. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 56f833efa427ccb444c0f9ad1759af1012f2124d. It is advisable to implement a patch to correct this issue.

AnalysisAI

Path traversal in NousResearch hermes-agent 2026.5.29.2 allows low-privilege authenticated remote attackers to read files outside the intended directory by supplying crafted path traversal sequences in the Name argument of the skill_view function within tools/skills_tool.py. Impact is confined to limited confidentiality exposure - no integrity or availability effect - consistent with the CVSS 4.0 score of 2.1 (Low). A public exploit has been disclosed (CVSS E:P), though no active exploitation has been confirmed via CISA KEV.

Technical ContextAI

The vulnerable component is the skill_view function in tools/skills_tool.py of the NousResearch hermes-agent framework (version 2026.5.29.2), an AI agent orchestration library. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) identifies the root cause: the application constructs a file path using the user-supplied Name argument without adequately sanitizing directory traversal sequences (e.g., ../). This allows the resolved path to escape the intended skills directory and reference arbitrary files on the underlying filesystem. No CPE string was provided in the source data; the affected product is tracked via its GitHub repository at https://github.com/NousResearch/hermes-agent/.

RemediationAI

Apply the upstream fix via commit 56f833efa427ccb444c0f9ad1759af1012f2124d, available at https://github.com/NousResearch/hermes-agent/commit/56f833efa427ccb444c0f9ad1759af1012f2124d and tracked in pull request https://github.com/NousResearch/hermes-agent/pull/40566. Note that this fix exists as an upstream commit and PR only - a tagged patched release version has not been independently confirmed from available data, so operators should verify the commit is merged into their deployed branch. If immediate patching is not feasible, restrict authenticated access to the skill_view endpoint to the minimum necessary user set, and implement server-side input validation on the Name parameter to reject path traversal sequences (e.g., ../, ..\); be aware that denylist-based sanitization alone may be bypassable via encoding variants, so allowlist-based validation (permitting only alphanumeric skill names) is preferable.