Hermes Agent EUVD-2026-67867

Exploitation requires (1) the attacker to first compromise the specific third-party upstream repository that a Hermes Agent MCP catalog entry references, and (2) that entry to be resolved via a mutable branch reference rather than a pinned commit SHA - the exact insecure configuration named in the description. A victim operator must install or update the affected catalog entry (the passive user interaction reflected in UI:P), after which propagation is automatic with no further operator action. Limiting factors: only Hermes Agent 0.18.2-0.18.x (before 0.19.0) are affected, the upstream-compromise prerequisite makes this high-complexity (AC:H) rather than trivially exploitable, and hosts that never install the vulnerable catalog entry are not exposed.

Signals are mixed and warrant careful reading. The vendor CVSS 4.0 base score is 9.0 (Critical) with AV:N and full High impact to both the vulnerable and subsequent systems (VC/VI/VA and SC/SI/SA all High), reflecting the fan-out of a supply-chain compromise. However AC:H and UI:P materially constrain real-world exploitation: the attacker must first compromise the upstream repository (non-trivial) and a victim must install/update the catalog entry. There is no EPSS score in the provided data, no KEV listing, and no POC reference, so this reads as a high-impact-but-precondition-heavy issue rather than a demonstrated, widely-exploited one. Note a tension worth flagging: the description states 'no further action required by the operator' (implying autonomous propagation) while the CVSS vector carries UI:P - reconcile by treating the initial catalog install/update as the passive user interaction, after which propagation is automatic. Verify EPSS/POC status with VulnCheck before final prioritization.

An attacker gains write access to a third-party upstream repository that a Hermes Agent MCP catalog entry tracks by branch, then commits malicious code to that branch head. When operators install or update the affected catalog entry, their hosts pull and execute the attacker's code, yielding remote code execution across every installing host. No public POC is identified at time of analysis, and the attack's difficulty is dominated by the upstream-compromise step (CVSS AC:H).