Hermes Agent
Monthly
Server-side request forgery in NousResearch hermes-agent 0.18.0 allows authenticated remote attackers to issue arbitrary HTTP requests from the application server by supplying a crafted URL to the fetchLinkTitle function in the Link Title Fetch component (apps/desktop/src/app/artifacts/index.tsx). The CVSS 4.0 vector (PR:L, VC:L/VI:L/VA:L) indicates limited but real impact: an attacker with valid credentials could probe internal network services, cloud metadata endpoints, or otherwise unreachable hosts. No public exploit code and no vendor patch have been identified; the vendor did not respond to coordinated disclosure.
Authorization bypass in NousResearch hermes-agent 0.18.0 allows unauthenticated remote attackers to manipulate the `session_id` argument passed to the `_sess_nowait` function in `s71.py`, circumventing session-based access controls without supplying valid credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivially network-reachable exploitation with no prerequisites, though impact is bounded at low across confidentiality, integrity, and availability, yielding a CVSS 4.0 score of 6.9. No vendor patch exists; NousResearch did not respond to the reporter's disclosure, and no public exploit code has been identified at time of analysis.
Uncontrolled memory allocation in NousResearch hermes-agent up to 0.18.2 allows a low-privileged remote attacker to exhaust memory resources by manipulating input to the list_tools function within the MCP Tool component (tools/mcp_tool.py). The vulnerability is a denial-of-service class issue (CWE-789) with low availability impact per the CVSS 4.0 vector, and a public proof-of-concept report describing resource amplification behavior has been published on GitHub. No vendor patch exists, as the vendor did not respond to coordinated disclosure.
Denial of service in NousResearch hermes-agent affects the HermesACPAgent.prompt function within acp_adapter/session.py, exploitable by low-privileged remote users through the ACP Prompt Workflow interface. Versions up to and including 0.18.2 are confirmed affected, with no vendor patch issued following pre-disclosure contact. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation against exposed deployments.
Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.
Improper access control in NousResearch hermes-agent up to 0.16.0 allows low-privileged authenticated users to invoke the Memory Toolset even when it has been explicitly disabled by an operator via the `disabled_toolsets` configuration. The root cause is a missing guard in `init_agent()` within `agent/agent_init.py`, which unconditionally injected the Memory Toolset regardless of operator-level restrictions. A public proof-of-concept exploit exists (GitHub issue #48181), and a vendor patch is available via pull request #46185.
Incorrect privilege assignment in NousResearch hermes-agent through 0.16.0 allows authenticated remote users to invoke toolsets that administrators have explicitly disabled via the disabled_toolsets configuration. The flaw resides in get_tool_definitions within agent/agent_init.py, where the disabled_toolsets list was not checked before injecting tool definitions into an agent session, causing disabled tools (e.g., 'memory') to remain fully accessible. No active exploitation is confirmed (not in CISA KEV), but a public proof-of-concept exists via GitHub issue #46171 and an upstream fix is available in PR #46185.
Server-side request forgery in NousResearch hermes-agent up to version 0.16.0 allows low-privileged remote attackers to manipulate the server into issuing arbitrary HTTP requests via the browser_snapshot function in tools/browser_tool.py. Exploitation can expose internal network services, cloud provider metadata endpoints, and other non-public resources reachable from the server. A public proof-of-concept exploit has been disclosed; the vendor did not respond to coordinated disclosure.
Server-side request forgery in NousResearch hermes-agent through version 0.16.0 allows authenticated remote attackers to coerce the server into making arbitrary outbound HTTP requests by supplying a crafted URL to the xAI Image Generation Provider component. The vulnerability resides in the save_url_image function within agent/image_gen_provider.py, which fails to validate or restrict URLs before fetching them server-side. A proof-of-concept exploit has been publicly disclosed on GitHub; no vendor patch exists as the vendor did not respond to disclosure outreach.
Incorrect authorization in NousResearch hermes-agent's Quick Command Handler allows low-privileged remote attackers to bypass slash command access controls via a flaw in the `_check_slash_access` function within `gateway/run.py`. All versions through 2026.6.5 are confirmed affected, with a public proof-of-concept exploit available on GitHub. The vendor did not respond to responsible disclosure, leaving no official patch available at time of analysis.
We need to analyze the provided data for CVE-2026-17432 and synthesize a JSON output per the instructions. First, extract relevant info: - CVE ID: CVE-2026-17432 - Description: Vulnerability in NousResearch hermes-agent 2026.6.5, in file hermes-agent/plugins/platforms/simplex/adapter.py, component SimpleX Gateway Authorization. Manipulation of argument contactId results in improper access controls. Attack may be launched remotely, high complexity, difficult exploitation. Exploit is public, patch available. Patch identified as commit 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3. CVSS Score 1.3, vector CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/R:X/V:X/RE:X/U:X - CWE: CWE-284 (Improper Access Control) - EPSS: 0.23%, percentile 14% -> low exploitation probability. - KEV: not mentioned, so not in KEV -> no active exploitation. Tags include "Authentication Bypass, Hermes Agent" - POC/Exploit: Publicly available (tag says exploit public, references include exploit URL) - Patch: Available from vendor (patch commit and PR) - Reported by: VulDB - CPE: cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:* -> vulnerable versions all, but description and EUVD mention version 2026.6.5 specifically? EUVD affected versions: ["hermes-agent 2026.6.5"] - ENISA EUVD ID: EUVD-2026-49046 - References: multiple vuldb pages, github issues, PR diff, commit. The PR diff provides crucial technical details: the vulnerability is in the SimpleX Gateway Authorization mechanism. The adapter.py originally used both user_id (contactId) and source.user_name (the contact's self-asserted profile display name) for authorization allowlist. This allowed an attacker to rename their profile to an allowlisted value and gain unauthorized access. The fix changes to use source.user_id_alt (local display name) instead of source.user_name, which is stable and not attacker-controlled. This is essentially an
Cross-site scripting in NousResearch hermes-agent (all versions through 2026.5.29.2) stems from unsanitized markdown-to-HTML conversion in the Matrix Adapter component, allowing an authenticated remote attacker to inject malicious scripts into Matrix platform messages. When a victim views the crafted content, the injected script executes in their browser context. Publicly available exploit code exists (GitHub issue #42667), though no public exploit identified at time of analysis maps to confirmed active exploitation - the CVSS 4.0 score of 2.0 reflects the low severity, limited scope, and required victim interaction.
Path traversal in NousResearch hermes-agent (all versions through 2026.5.16) exposes arbitrary server-side files via the Live Webhook Endpoint's `extract_media` function in `gateway/platforms/base.py`. Remote, unauthenticated attackers can read files outside the intended directory, resulting in low-confidentiality-impact disclosure - potentially exposing configuration files, credentials, or internal data. A public proof-of-concept exploit is available on GitHub; however, this vulnerability has not been listed in CISA KEV, indicating active exploitation is not yet confirmed at time of analysis.
Improper authentication in NousResearch hermes-agent through version 0.15.2 allows remote attackers to bypass the Discord user allowlist by exploiting a logic flaw in the `DiscordAdapter._is_allowed_user` function within `gateway/platforms/discord.py`. Exploitation is rated high complexity (CVSS 4.0 AC:H), resulting in limited but confirmed confidentiality, integrity, and availability impact against the vulnerable system. A public proof-of-concept exploit has been disclosed via GitHub Gist; no vendor patch exists as the vendor did not respond to responsible disclosure.
Protection mechanism failure in NousResearch hermes-agent (≤ 0.15.2) allows remote authenticated attackers to bypass shell execution controls via the shell.exec function in tui_gateway/server.py, resulting in low-level confidentiality, integrity, and availability impact. The vulnerability is classified under CWE-693 and carries a CVSS 4.0 score of 5.3 (Medium), with a publicly available proof-of-concept exploit hosted on GitHub. No patch has been issued - the vendor did not respond to the researcher's disclosure - meaning all deployments of hermes-agent up to and including version 0.15.2 remain exposed.
Insecure default file permissions (mode 0o644) in Hermes Agent before v0.16.0 expose two sensitive data files - response_store.db and webhook_subscriptions.json - to any local user on the host system, enabling direct extraction of conversation history, tool payloads, prompts, and per-route HMAC webhook secrets. Any locally authenticated user on the same host can read these files without elevated privileges. HMAC secret exposure is particularly severe because it enables forging authenticated webhook requests, extending impact beyond passive information disclosure into potential privilege escalation - consistent with the 'Privilege Escalation' tag in the intelligence record. No public exploit has been identified at time of analysis, and this is not currently listed in CISA KEV.
DNS rebinding in NousResearch Hermes Agent prior to 0.16.0 allows remote attackers to reach privileged local WebSocket endpoints (/api/pty, /api/ws, /api/pub, /api/events) by tricking a victim's browser into resolving an attacker-controlled hostname to the agent's loopback address, bypassing Host and Origin checks. Because FastAPI HTTP middleware does not run on WebSocket upgrade requests, the validation layer is silently skipped, letting attackers inject commands into the PTY or stream terminal output. No public exploit has been identified at time of analysis, but VulnCheck reported the issue and an upstream patch is available.
Authorization bypass in NousResearch hermes-agent up to 0.12.0 allows remote low-privileged authenticated attackers to access or manipulate sessions belonging to other users by supplying an arbitrary session title to the resume endpoint's `resolve_session_by_title` function without ownership verification. A public proof-of-concept exploit has been disclosed via GitHub Gist, and the vendor did not respond to pre-disclosure contact, meaning no patch is currently available. With CVSS 6.3 and a temporal exploit-partial modifier, this presents elevated practical risk in multi-tenant or shared-instance deployments where session isolation is a security boundary.
Improper authentication in NousResearch hermes-agent through version 2026.4.23 allows a local low-privileged attacker to manipulate the Credential Pool Synchronization component, specifically the `_sync_anthropic_entry_from_credentials_file` function in `agent/credential_pool.py`, bypassing authentication controls over Anthropic API credentials. A proof-of-concept exploit is publicly available on GitHub and the vendor did not respond to coordinated disclosure, leaving no patch available at time of analysis. No public exploit identified at time of analysis for active KEV-confirmed campaigns, but publicly available exploit code exists and lowers the bar for any attacker already holding local system access.
Uncontrolled resource consumption in NousResearch hermes-agent (all versions through 2026.4.30) allows remote unauthenticated attackers to degrade service availability by sending crafted requests to the Feishu webhook endpoint. The vulnerable function `_handle_webhook_request` in `gateway/platforms/feishu.py` fails to bound resource usage during webhook processing, enabling denial-of-service conditions. A publicly available proof-of-concept exploit exists (hosted on GitHub), the vendor did not respond to responsible disclosure, and no patch has been released - leaving all deployments with active Feishu integration exposed with no official remediation path.
Injection vulnerability in NousResearch hermes-agent's `_scan_memory_content` function exposes authenticated low-privileged remote users to partial confidentiality, integrity, and availability compromise across all versions through 2026.4.30. The flaw originates in `tools/memory_tool.py`, where user-controlled input is insufficiently neutralized before being passed to downstream components. No public exploit identified at time of analysis is incorrect - a public proof-of-concept exploit exists (GitHub gist), and the vendor has not responded to responsible disclosure, meaning no patch has been released.
Injection vulnerability in NousResearch hermes-agent (all versions through 2026.4.30) allows remote unauthenticated attackers to exploit improper neutralization in the _sanitize_env_lines function of hermes_cli/config.py, achieving partial confidentiality, integrity, and availability impact. The flaw is tagged as code injection (CWE-74), meaning attacker-controlled input passed through this sanitization routine may reach a downstream component in an executable or interpreted context. A public proof-of-concept exploit exists (GitHub gist), though the CVSS vector assigns high attack complexity, indicating exploitation is not trivial. No vendor patch exists; the vendor was unresponsive to coordinated disclosure.
Remote code/prompt injection in NousResearch Hermes Agent through 0.12.0 stems from improper neutralization in the _compress_context function within run_agent.py (CWE-74). Publicly available exploit code exists and the issue is remotely triggerable without authentication per the CVSS vector, though impact is bounded to Low across confidentiality, integrity, and availability. The vendor was contacted but did not respond, leaving downstream users without an official fix at time of analysis.
Remote injection in NousResearch Hermes Agent through version 2026.4.30 allows unauthenticated attackers to manipulate the _serve_plugin_skill/skill_view function in tools/skills_tool.py. Publicly available exploit code exists via a GitHub gist, and the vendor has not responded to disclosure attempts, leaving deployments without an official fix. CVSS 7.3 reflects network-reachable, low-complexity exploitation with partial impact across confidentiality, integrity, and availability.
Local privilege escalation in NousResearch hermes-agent 2026.4.23 allows authenticated local users to manipulate plugin discovery logic via HERMES_ENABLE_PROJECT_PLUGINS environment variable, resulting in unauthorized information disclosure and potential integrity compromise of the CLI web-dashboard interface. Publicly available exploit code exists (EPSS data not provided, not listed in CISA KEV). The vendor did not respond to responsible disclosure attempts, leaving remediation status uncertain.
Remote sandbox escape in NousResearch hermes-agent versions up to 2026.4.16 allows unauthenticated attackers to manipulate environment variables through the code execution tool, potentially breaking out of the intended security sandbox. The vulnerability has publicly available exploit code and the vendor has not responded to disclosure attempts, leaving systems unpatched.
Remote command injection in NousResearch hermes-agent allows unauthenticated attackers to execute arbitrary OS commands through the terminal_tool component's approval mechanism. The vulnerability affects all versions up to commit 5157f5427f19488b31c6fdebbacd15d798ce7f63 and has publicly available exploit code demonstrating the attack. The vendor has not responded to disclosure attempts, leaving users without an official patch.
Code injection in NousResearch hermes-agent 2026.4.23 allows remote unauthenticated attackers to inject and execute arbitrary code through the _scan_context_content function in agent/prompt_builder.py. The vulnerability has publicly available exploit code and affects all versions up to 2026.4.23, with the vendor failing to respond to disclosure attempts.
Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers to manipulate message formatting in Slack and Mattermost integrations, potentially leading to information disclosure and service disruption. The vulnerability is exploitable via crafted format_message arguments with low attack complexity and requires no user interaction. Public exploit code is available via GitHub Gist. The vendor did not respond to early disclosure attempts, and no patch availability is documented.
Remote injection vulnerability in NousResearch hermes-agent versions up to 2026.4.23 enables unauthenticated attackers to inject malicious payloads through the Skills Guard component's multi-word prompt handling mechanism. The vulnerability has publicly available exploit code and allows attackers to achieve limited confidentiality, integrity, and availability impacts without user interaction. Despite early vendor notification, no response or patch has been provided.
Information disclosure in NousResearch hermes-agent allows remote unauthenticated attackers to extract sensitive data via crafted requests to the Messaging Gateway Handler's environment configuration function. The vulnerability affects versions up to 2026.4.23 with publicly available exploit code demonstrating the attack. EPSS data not provided, but public POC availability increases immediate risk. Vendor has not responded to disclosure, suggesting no official patch timeline.
Path traversal in NousResearch hermes-agent through version 2026.4.16 allows remote unauthenticated attackers to bypass path restrictions and modify or disrupt file operations via the read_file tool. The flaw exists in the _is_blocked_device function within tools/file_tools.py. Public exploit code is available (EPSS data not provided, but exploit confirmed). Vendor was notified but did not respond, suggesting no official patch exists at time of analysis.
Missing authorization in NousResearch hermes-agent versions up to 2026.4.16 allows remote attackers to bypass authentication checks in the Batch Runner component, potentially executing unauthorized commands. The vulnerability affects the check_all_command_guards function in tools/approval.py and can be exploited without authentication. Publicly available exploit code exists, though the vulnerability is not yet confirmed in CISA KEV.
Symlink following in NousResearch hermes-agent 0.8.0 allows local low-privileged users to bypass sensitive filesystem path protections and write to restricted system files. The `_check_sensitive_path` function in `tools/file_tools.py` validated only the fully-resolved real path, not the original expanded path, enabling bypass on platforms where system directories are themselves symlinks (e.g., macOS `/etc` → `/private/etc`). A publicly available PoC exists; no confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 score of 1.9 with EPSS at the 2nd percentile indicates low real-world risk.
Path traversal in NousResearch hermes-agent 0.8.0 exposes arbitrary server-side files to unauthenticated remote attackers through the WeChat Work (WeCom) platform adapter component. The vulnerability resides in gateway/platforms/wecom.py and is limited to confidentiality impact (VC:L), with no integrity or availability consequence. A public proof-of-concept exists per GitHub issue reference, though EPSS of 0.05% (15th percentile) and SSVC's 'Automatable: no' designation indicate constrained real-world exploitation risk; no CISA KEV listing has been confirmed.
Authentication bypass in hermes-agent 0.8.0 webhook endpoint allows remote attackers to bypass authentication controls via manipulation of the _INSECURE_NO_AUTH parameter, resulting in limited confidentiality and integrity impact. The vulnerability requires high attack complexity and has publicly available exploit code; vendor patch is available but the project has not yet merged the fix despite early notification.
Improper authentication in the API_SERVER_KEY handler of NousResearch hermes-agent 0.8.0 allows remote attackers to bypass authentication checks in the _check_auth function via the API server component. The vulnerability has a CVSS score of 6.3 with high attack complexity, and publicly available exploit code exists. The project has not yet responded to early notification via pull request.
Server-side request forgery in NousResearch hermes-agent 0.18.0 allows authenticated remote attackers to issue arbitrary HTTP requests from the application server by supplying a crafted URL to the fetchLinkTitle function in the Link Title Fetch component (apps/desktop/src/app/artifacts/index.tsx). The CVSS 4.0 vector (PR:L, VC:L/VI:L/VA:L) indicates limited but real impact: an attacker with valid credentials could probe internal network services, cloud metadata endpoints, or otherwise unreachable hosts. No public exploit code and no vendor patch have been identified; the vendor did not respond to coordinated disclosure.
Authorization bypass in NousResearch hermes-agent 0.18.0 allows unauthenticated remote attackers to manipulate the `session_id` argument passed to the `_sess_nowait` function in `s71.py`, circumventing session-based access controls without supplying valid credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivially network-reachable exploitation with no prerequisites, though impact is bounded at low across confidentiality, integrity, and availability, yielding a CVSS 4.0 score of 6.9. No vendor patch exists; NousResearch did not respond to the reporter's disclosure, and no public exploit code has been identified at time of analysis.
Uncontrolled memory allocation in NousResearch hermes-agent up to 0.18.2 allows a low-privileged remote attacker to exhaust memory resources by manipulating input to the list_tools function within the MCP Tool component (tools/mcp_tool.py). The vulnerability is a denial-of-service class issue (CWE-789) with low availability impact per the CVSS 4.0 vector, and a public proof-of-concept report describing resource amplification behavior has been published on GitHub. No vendor patch exists, as the vendor did not respond to coordinated disclosure.
Denial of service in NousResearch hermes-agent affects the HermesACPAgent.prompt function within acp_adapter/session.py, exploitable by low-privileged remote users through the ACP Prompt Workflow interface. Versions up to and including 0.18.2 are confirmed affected, with no vendor patch issued following pre-disclosure contact. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation against exposed deployments.
Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.
Improper access control in NousResearch hermes-agent up to 0.16.0 allows low-privileged authenticated users to invoke the Memory Toolset even when it has been explicitly disabled by an operator via the `disabled_toolsets` configuration. The root cause is a missing guard in `init_agent()` within `agent/agent_init.py`, which unconditionally injected the Memory Toolset regardless of operator-level restrictions. A public proof-of-concept exploit exists (GitHub issue #48181), and a vendor patch is available via pull request #46185.
Incorrect privilege assignment in NousResearch hermes-agent through 0.16.0 allows authenticated remote users to invoke toolsets that administrators have explicitly disabled via the disabled_toolsets configuration. The flaw resides in get_tool_definitions within agent/agent_init.py, where the disabled_toolsets list was not checked before injecting tool definitions into an agent session, causing disabled tools (e.g., 'memory') to remain fully accessible. No active exploitation is confirmed (not in CISA KEV), but a public proof-of-concept exists via GitHub issue #46171 and an upstream fix is available in PR #46185.
Server-side request forgery in NousResearch hermes-agent up to version 0.16.0 allows low-privileged remote attackers to manipulate the server into issuing arbitrary HTTP requests via the browser_snapshot function in tools/browser_tool.py. Exploitation can expose internal network services, cloud provider metadata endpoints, and other non-public resources reachable from the server. A public proof-of-concept exploit has been disclosed; the vendor did not respond to coordinated disclosure.
Server-side request forgery in NousResearch hermes-agent through version 0.16.0 allows authenticated remote attackers to coerce the server into making arbitrary outbound HTTP requests by supplying a crafted URL to the xAI Image Generation Provider component. The vulnerability resides in the save_url_image function within agent/image_gen_provider.py, which fails to validate or restrict URLs before fetching them server-side. A proof-of-concept exploit has been publicly disclosed on GitHub; no vendor patch exists as the vendor did not respond to disclosure outreach.
Incorrect authorization in NousResearch hermes-agent's Quick Command Handler allows low-privileged remote attackers to bypass slash command access controls via a flaw in the `_check_slash_access` function within `gateway/run.py`. All versions through 2026.6.5 are confirmed affected, with a public proof-of-concept exploit available on GitHub. The vendor did not respond to responsible disclosure, leaving no official patch available at time of analysis.
We need to analyze the provided data for CVE-2026-17432 and synthesize a JSON output per the instructions. First, extract relevant info: - CVE ID: CVE-2026-17432 - Description: Vulnerability in NousResearch hermes-agent 2026.6.5, in file hermes-agent/plugins/platforms/simplex/adapter.py, component SimpleX Gateway Authorization. Manipulation of argument contactId results in improper access controls. Attack may be launched remotely, high complexity, difficult exploitation. Exploit is public, patch available. Patch identified as commit 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3. CVSS Score 1.3, vector CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/R:X/V:X/RE:X/U:X - CWE: CWE-284 (Improper Access Control) - EPSS: 0.23%, percentile 14% -> low exploitation probability. - KEV: not mentioned, so not in KEV -> no active exploitation. Tags include "Authentication Bypass, Hermes Agent" - POC/Exploit: Publicly available (tag says exploit public, references include exploit URL) - Patch: Available from vendor (patch commit and PR) - Reported by: VulDB - CPE: cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:* -> vulnerable versions all, but description and EUVD mention version 2026.6.5 specifically? EUVD affected versions: ["hermes-agent 2026.6.5"] - ENISA EUVD ID: EUVD-2026-49046 - References: multiple vuldb pages, github issues, PR diff, commit. The PR diff provides crucial technical details: the vulnerability is in the SimpleX Gateway Authorization mechanism. The adapter.py originally used both user_id (contactId) and source.user_name (the contact's self-asserted profile display name) for authorization allowlist. This allowed an attacker to rename their profile to an allowlisted value and gain unauthorized access. The fix changes to use source.user_id_alt (local display name) instead of source.user_name, which is stable and not attacker-controlled. This is essentially an
Cross-site scripting in NousResearch hermes-agent (all versions through 2026.5.29.2) stems from unsanitized markdown-to-HTML conversion in the Matrix Adapter component, allowing an authenticated remote attacker to inject malicious scripts into Matrix platform messages. When a victim views the crafted content, the injected script executes in their browser context. Publicly available exploit code exists (GitHub issue #42667), though no public exploit identified at time of analysis maps to confirmed active exploitation - the CVSS 4.0 score of 2.0 reflects the low severity, limited scope, and required victim interaction.
Path traversal in NousResearch hermes-agent (all versions through 2026.5.16) exposes arbitrary server-side files via the Live Webhook Endpoint's `extract_media` function in `gateway/platforms/base.py`. Remote, unauthenticated attackers can read files outside the intended directory, resulting in low-confidentiality-impact disclosure - potentially exposing configuration files, credentials, or internal data. A public proof-of-concept exploit is available on GitHub; however, this vulnerability has not been listed in CISA KEV, indicating active exploitation is not yet confirmed at time of analysis.
Improper authentication in NousResearch hermes-agent through version 0.15.2 allows remote attackers to bypass the Discord user allowlist by exploiting a logic flaw in the `DiscordAdapter._is_allowed_user` function within `gateway/platforms/discord.py`. Exploitation is rated high complexity (CVSS 4.0 AC:H), resulting in limited but confirmed confidentiality, integrity, and availability impact against the vulnerable system. A public proof-of-concept exploit has been disclosed via GitHub Gist; no vendor patch exists as the vendor did not respond to responsible disclosure.
Protection mechanism failure in NousResearch hermes-agent (≤ 0.15.2) allows remote authenticated attackers to bypass shell execution controls via the shell.exec function in tui_gateway/server.py, resulting in low-level confidentiality, integrity, and availability impact. The vulnerability is classified under CWE-693 and carries a CVSS 4.0 score of 5.3 (Medium), with a publicly available proof-of-concept exploit hosted on GitHub. No patch has been issued - the vendor did not respond to the researcher's disclosure - meaning all deployments of hermes-agent up to and including version 0.15.2 remain exposed.
Insecure default file permissions (mode 0o644) in Hermes Agent before v0.16.0 expose two sensitive data files - response_store.db and webhook_subscriptions.json - to any local user on the host system, enabling direct extraction of conversation history, tool payloads, prompts, and per-route HMAC webhook secrets. Any locally authenticated user on the same host can read these files without elevated privileges. HMAC secret exposure is particularly severe because it enables forging authenticated webhook requests, extending impact beyond passive information disclosure into potential privilege escalation - consistent with the 'Privilege Escalation' tag in the intelligence record. No public exploit has been identified at time of analysis, and this is not currently listed in CISA KEV.
DNS rebinding in NousResearch Hermes Agent prior to 0.16.0 allows remote attackers to reach privileged local WebSocket endpoints (/api/pty, /api/ws, /api/pub, /api/events) by tricking a victim's browser into resolving an attacker-controlled hostname to the agent's loopback address, bypassing Host and Origin checks. Because FastAPI HTTP middleware does not run on WebSocket upgrade requests, the validation layer is silently skipped, letting attackers inject commands into the PTY or stream terminal output. No public exploit has been identified at time of analysis, but VulnCheck reported the issue and an upstream patch is available.
Authorization bypass in NousResearch hermes-agent up to 0.12.0 allows remote low-privileged authenticated attackers to access or manipulate sessions belonging to other users by supplying an arbitrary session title to the resume endpoint's `resolve_session_by_title` function without ownership verification. A public proof-of-concept exploit has been disclosed via GitHub Gist, and the vendor did not respond to pre-disclosure contact, meaning no patch is currently available. With CVSS 6.3 and a temporal exploit-partial modifier, this presents elevated practical risk in multi-tenant or shared-instance deployments where session isolation is a security boundary.
Improper authentication in NousResearch hermes-agent through version 2026.4.23 allows a local low-privileged attacker to manipulate the Credential Pool Synchronization component, specifically the `_sync_anthropic_entry_from_credentials_file` function in `agent/credential_pool.py`, bypassing authentication controls over Anthropic API credentials. A proof-of-concept exploit is publicly available on GitHub and the vendor did not respond to coordinated disclosure, leaving no patch available at time of analysis. No public exploit identified at time of analysis for active KEV-confirmed campaigns, but publicly available exploit code exists and lowers the bar for any attacker already holding local system access.
Uncontrolled resource consumption in NousResearch hermes-agent (all versions through 2026.4.30) allows remote unauthenticated attackers to degrade service availability by sending crafted requests to the Feishu webhook endpoint. The vulnerable function `_handle_webhook_request` in `gateway/platforms/feishu.py` fails to bound resource usage during webhook processing, enabling denial-of-service conditions. A publicly available proof-of-concept exploit exists (hosted on GitHub), the vendor did not respond to responsible disclosure, and no patch has been released - leaving all deployments with active Feishu integration exposed with no official remediation path.
Injection vulnerability in NousResearch hermes-agent's `_scan_memory_content` function exposes authenticated low-privileged remote users to partial confidentiality, integrity, and availability compromise across all versions through 2026.4.30. The flaw originates in `tools/memory_tool.py`, where user-controlled input is insufficiently neutralized before being passed to downstream components. No public exploit identified at time of analysis is incorrect - a public proof-of-concept exploit exists (GitHub gist), and the vendor has not responded to responsible disclosure, meaning no patch has been released.
Injection vulnerability in NousResearch hermes-agent (all versions through 2026.4.30) allows remote unauthenticated attackers to exploit improper neutralization in the _sanitize_env_lines function of hermes_cli/config.py, achieving partial confidentiality, integrity, and availability impact. The flaw is tagged as code injection (CWE-74), meaning attacker-controlled input passed through this sanitization routine may reach a downstream component in an executable or interpreted context. A public proof-of-concept exploit exists (GitHub gist), though the CVSS vector assigns high attack complexity, indicating exploitation is not trivial. No vendor patch exists; the vendor was unresponsive to coordinated disclosure.
Remote code/prompt injection in NousResearch Hermes Agent through 0.12.0 stems from improper neutralization in the _compress_context function within run_agent.py (CWE-74). Publicly available exploit code exists and the issue is remotely triggerable without authentication per the CVSS vector, though impact is bounded to Low across confidentiality, integrity, and availability. The vendor was contacted but did not respond, leaving downstream users without an official fix at time of analysis.
Remote injection in NousResearch Hermes Agent through version 2026.4.30 allows unauthenticated attackers to manipulate the _serve_plugin_skill/skill_view function in tools/skills_tool.py. Publicly available exploit code exists via a GitHub gist, and the vendor has not responded to disclosure attempts, leaving deployments without an official fix. CVSS 7.3 reflects network-reachable, low-complexity exploitation with partial impact across confidentiality, integrity, and availability.
Local privilege escalation in NousResearch hermes-agent 2026.4.23 allows authenticated local users to manipulate plugin discovery logic via HERMES_ENABLE_PROJECT_PLUGINS environment variable, resulting in unauthorized information disclosure and potential integrity compromise of the CLI web-dashboard interface. Publicly available exploit code exists (EPSS data not provided, not listed in CISA KEV). The vendor did not respond to responsible disclosure attempts, leaving remediation status uncertain.
Remote sandbox escape in NousResearch hermes-agent versions up to 2026.4.16 allows unauthenticated attackers to manipulate environment variables through the code execution tool, potentially breaking out of the intended security sandbox. The vulnerability has publicly available exploit code and the vendor has not responded to disclosure attempts, leaving systems unpatched.
Remote command injection in NousResearch hermes-agent allows unauthenticated attackers to execute arbitrary OS commands through the terminal_tool component's approval mechanism. The vulnerability affects all versions up to commit 5157f5427f19488b31c6fdebbacd15d798ce7f63 and has publicly available exploit code demonstrating the attack. The vendor has not responded to disclosure attempts, leaving users without an official patch.
Code injection in NousResearch hermes-agent 2026.4.23 allows remote unauthenticated attackers to inject and execute arbitrary code through the _scan_context_content function in agent/prompt_builder.py. The vulnerability has publicly available exploit code and affects all versions up to 2026.4.23, with the vendor failing to respond to disclosure attempts.
Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers to manipulate message formatting in Slack and Mattermost integrations, potentially leading to information disclosure and service disruption. The vulnerability is exploitable via crafted format_message arguments with low attack complexity and requires no user interaction. Public exploit code is available via GitHub Gist. The vendor did not respond to early disclosure attempts, and no patch availability is documented.
Remote injection vulnerability in NousResearch hermes-agent versions up to 2026.4.23 enables unauthenticated attackers to inject malicious payloads through the Skills Guard component's multi-word prompt handling mechanism. The vulnerability has publicly available exploit code and allows attackers to achieve limited confidentiality, integrity, and availability impacts without user interaction. Despite early vendor notification, no response or patch has been provided.
Information disclosure in NousResearch hermes-agent allows remote unauthenticated attackers to extract sensitive data via crafted requests to the Messaging Gateway Handler's environment configuration function. The vulnerability affects versions up to 2026.4.23 with publicly available exploit code demonstrating the attack. EPSS data not provided, but public POC availability increases immediate risk. Vendor has not responded to disclosure, suggesting no official patch timeline.
Path traversal in NousResearch hermes-agent through version 2026.4.16 allows remote unauthenticated attackers to bypass path restrictions and modify or disrupt file operations via the read_file tool. The flaw exists in the _is_blocked_device function within tools/file_tools.py. Public exploit code is available (EPSS data not provided, but exploit confirmed). Vendor was notified but did not respond, suggesting no official patch exists at time of analysis.
Missing authorization in NousResearch hermes-agent versions up to 2026.4.16 allows remote attackers to bypass authentication checks in the Batch Runner component, potentially executing unauthorized commands. The vulnerability affects the check_all_command_guards function in tools/approval.py and can be exploited without authentication. Publicly available exploit code exists, though the vulnerability is not yet confirmed in CISA KEV.
Symlink following in NousResearch hermes-agent 0.8.0 allows local low-privileged users to bypass sensitive filesystem path protections and write to restricted system files. The `_check_sensitive_path` function in `tools/file_tools.py` validated only the fully-resolved real path, not the original expanded path, enabling bypass on platforms where system directories are themselves symlinks (e.g., macOS `/etc` → `/private/etc`). A publicly available PoC exists; no confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 score of 1.9 with EPSS at the 2nd percentile indicates low real-world risk.
Path traversal in NousResearch hermes-agent 0.8.0 exposes arbitrary server-side files to unauthenticated remote attackers through the WeChat Work (WeCom) platform adapter component. The vulnerability resides in gateway/platforms/wecom.py and is limited to confidentiality impact (VC:L), with no integrity or availability consequence. A public proof-of-concept exists per GitHub issue reference, though EPSS of 0.05% (15th percentile) and SSVC's 'Automatable: no' designation indicate constrained real-world exploitation risk; no CISA KEV listing has been confirmed.
Authentication bypass in hermes-agent 0.8.0 webhook endpoint allows remote attackers to bypass authentication controls via manipulation of the _INSECURE_NO_AUTH parameter, resulting in limited confidentiality and integrity impact. The vulnerability requires high attack complexity and has publicly available exploit code; vendor patch is available but the project has not yet merged the fix despite early notification.
Improper authentication in the API_SERVER_KEY handler of NousResearch hermes-agent 0.8.0 allows remote attackers to bypass authentication checks in the _check_auth function via the API server component. The vulnerability has a CVSS score of 6.3 with high attack complexity, and publicly available exploit code exists. The project has not yet responded to early notification via pull request.