Nousresearch

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-71963	Remote code execution in NousResearch Hermes Agent 0.18.2-0.21.0 allows an unauthenticated attacker to execute arbitrary OS commands in the victim's process context by supplying a malicious git repository containing a crafted `.git/config` that sets `core.fsmonitor` to an attacker-controlled binary or script. Exploitation is triggered the moment a user opens the malicious repository and sends any message, causing the agent's internal git status call to invoke the injected command and expose the full process environment - including configured LLM provider API keys. A public exploit writeup exists (manifold.security), and a patch was released as commit f6234d0.	HIGH	8.6	0.9%	64	PoC
CVE-2026-14628	Path traversal in NousResearch hermes-agent (all versions through 2026.5.16) exposes arbitrary server-side files via the Live Webhook Endpoint's `extract_media` function in `gateway/platforms/base.py`. Remote, unauthenticated attackers can read files outside the intended directory, resulting in low-confidentiality-impact disclosure - potentially exposing configuration files, credentials, or internal data. A public proof-of-concept exploit is available on GitHub; however, this vulnerability has not been listed in CISA KEV, indicating active exploitation is not yet confirmed at time of analysis.	MEDIUM	5.5	0.6%	48	PoC No patch
CVE-2026-82021	Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.	CRITICAL	9.0	0.2%	45
CVE-2026-82020	Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.	HIGH	7.6	0.3%	38
CVE-2026-14627	Improper authentication in NousResearch hermes-agent through version 0.15.2 allows remote attackers to bypass the Discord user allowlist by exploiting a logic flaw in the `DiscordAdapter._is_allowed_user` function within `gateway/platforms/discord.py`. Exploitation is rated high complexity (CVSS 4.0 AC:H), resulting in limited but confirmed confidentiality, integrity, and availability impact against the vulnerable system. A public proof-of-concept exploit has been disclosed via GitHub Gist; no vendor patch exists as the vendor did not respond to responsible disclosure.	LOW	2.9	0.4%	35	PoC No patch
CVE-2026-85105	Authorization bypass in NousResearch hermes-agent 0.18.0 allows unauthenticated remote attackers to manipulate the `session_id` argument passed to the `_sess_nowait` function in `s71.py`, circumventing session-based access controls without supplying valid credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivially network-reachable exploitation with no prerequisites, though impact is bounded at low across confidentiality, integrity, and availability, yielding a CVSS 4.0 score of 6.9. No vendor patch exists; NousResearch did not respond to the reporter's disclosure, and no public exploit code has been identified at time of analysis.	MEDIUM	6.9	0.4%	34	No patch
CVE-2026-18775	Server-side request forgery in NousResearch hermes-agent up to version 0.16.0 allows low-privileged remote attackers to manipulate the server into issuing arbitrary HTTP requests via the browser_snapshot function in tools/browser_tool.py. Exploitation can expose internal network services, cloud provider metadata endpoints, and other non-public resources reachable from the server. A public proof-of-concept exploit has been disclosed; the vendor did not respond to coordinated disclosure.	LOW	2.1	0.3%	31	PoC No patch
CVE-2026-84288	Denial of service in NousResearch hermes-agent affects the HermesACPAgent.prompt function within acp_adapter/session.py, exploitable by low-privileged remote users through the ACP Prompt Workflow interface. Versions up to and including 0.18.2 are confirmed affected, with no vendor patch issued following pre-disclosure contact. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation against exposed deployments.	LOW	2.1	0.3%	31	PoC No patch
CVE-2026-84289	Uncontrolled memory allocation in NousResearch hermes-agent up to 0.18.2 allows a low-privileged remote attacker to exhaust memory resources by manipulating input to the list_tools function within the MCP Tool component (tools/mcp_tool.py). The vulnerability is a denial-of-service class issue (CWE-789) with low availability impact per the CVSS 4.0 vector, and a public proof-of-concept report describing resource amplification behavior has been published on GitHub. No vendor patch exists, as the vendor did not respond to coordinated disclosure.	LOW	2.1	0.3%	31	PoC No patch
CVE-2026-14625	Protection mechanism failure in NousResearch hermes-agent (≤ 0.15.2) allows remote authenticated attackers to bypass shell execution controls via the shell.exec function in tui_gateway/server.py, resulting in low-level confidentiality, integrity, and availability impact. The vulnerability is classified under CWE-693 and carries a CVSS 4.0 score of 5.3 (Medium), with a publicly available proof-of-concept exploit hosted on GitHub. No patch has been issued - the vendor did not respond to the researcher's disclosure - meaning all deployments of hermes-agent up to and including version 0.15.2 remain exposed.	LOW	2.1	0.2%	31	PoC No patch
CVE-2026-18993	Improper access control in NousResearch hermes-agent up to 0.16.0 allows low-privileged authenticated users to invoke the Memory Toolset even when it has been explicitly disabled by an operator via the `disabled_toolsets` configuration. The root cause is a missing guard in `init_agent()` within `agent/agent_init.py`, which unconditionally injected the Memory Toolset regardless of operator-level restrictions. A public proof-of-concept exploit exists (GitHub issue #48181), and a vendor patch is available via pull request #46185.	LOW	2.1	0.2%	31	PoC
CVE-2026-18976	Incorrect privilege assignment in NousResearch hermes-agent through 0.16.0 allows authenticated remote users to invoke toolsets that administrators have explicitly disabled via the disabled_toolsets configuration. The flaw resides in get_tool_definitions within agent/agent_init.py, where the disabled_toolsets list was not checked before injecting tool definitions into an agent session, causing disabled tools (e.g., 'memory') to remain fully accessible. No active exploitation is confirmed (not in CISA KEV), but a public proof-of-concept exists via GitHub issue #46171 and an upstream fix is available in PR #46185.	LOW	2.1	0.2%	31	PoC
CVE-2026-18773	Incorrect authorization in NousResearch hermes-agent's Quick Command Handler allows low-privileged remote attackers to bypass slash command access controls via a flaw in the `_check_slash_access` function within `gateway/run.py`. All versions through 2026.6.5 are confirmed affected, with a public proof-of-concept exploit available on GitHub. The vendor did not respond to responsible disclosure, leaving no official patch available at time of analysis.	LOW	2.1	0.2%	31	PoC No patch
CVE-2026-18774	Server-side request forgery in NousResearch hermes-agent through version 0.16.0 allows authenticated remote attackers to coerce the server into making arbitrary outbound HTTP requests by supplying a crafted URL to the xAI Image Generation Provider component. The vulnerability resides in the save_url_image function within agent/image_gen_provider.py, which fails to validate or restrict URLs before fetching them server-side. A proof-of-concept exploit has been publicly disclosed on GitHub; no vendor patch exists as the vendor did not respond to disclosure outreach.	LOW	2.1	0.2%	31	PoC No patch
CVE-2026-15311	Cross-site scripting in NousResearch hermes-agent (all versions through 2026.5.29.2) stems from unsanitized markdown-to-HTML conversion in the Matrix Adapter component, allowing an authenticated remote attacker to inject malicious scripts into Matrix platform messages. When a victim views the crafted content, the injected script executes in their browser context. Publicly available exploit code exists (GitHub issue #42667), though no public exploit identified at time of analysis maps to confirmed active exploitation - the CVSS 4.0 score of 2.0 reflects the low severity, limited scope, and required victim interaction.	LOW	2.0	0.2%	30	PoC

CVE-2026-71963

Remote code execution in NousResearch Hermes Agent 0.18.2-0.21.0 allows an unauthenticated attacker to execute arbitrary OS commands in the victim's process context by supplying a malicious git repository containing a crafted `.git/config` that sets `core.fsmonitor` to an attacker-controlled binary or script. Exploitation is triggered the moment a user opens the malicious repository and sends any message, causing the agent's internal git status call to invoke the injected command and expose the full process environment - including configured LLM provider API keys. A public exploit writeup exists (manifold.security), and a patch was released as commit f6234d0.

HIGH

8.6

0.9%

64

PoC

CVE-2026-14628

Path traversal in NousResearch hermes-agent (all versions through 2026.5.16) exposes arbitrary server-side files via the Live Webhook Endpoint's `extract_media` function in `gateway/platforms/base.py`. Remote, unauthenticated attackers can read files outside the intended directory, resulting in low-confidentiality-impact disclosure - potentially exposing configuration files, credentials, or internal data. A public proof-of-concept exploit is available on GitHub; however, this vulnerability has not been listed in CISA KEV, indicating active exploitation is not yet confirmed at time of analysis.

MEDIUM

5.5

0.6%

48

PoC No patch

CVE-2026-82021

Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

CRITICAL

9.0

0.2%

45

CVE-2026-82020

Credential store overwrite in NousResearch Hermes Agent versions 0.16.0 through pre-0.17.0 is achievable by any attacker who can inject content into messages ingested by the agent, exploiting a gap in the sensitive-path guard (CWE-552) that failed to properly exclude auth.json from the file-write tool's reachable paths. By crafting malicious message payloads, an attacker bypasses the path restriction and overwrites the credential store without triggering any protection, resulting in credential tampering and potential unauthorized access to all identities stored therein. No public exploit has been identified at time of analysis, and a vendor-released patch (v0.17.0) is available.

HIGH

7.6

0.3%

38

CVE-2026-14627

Improper authentication in NousResearch hermes-agent through version 0.15.2 allows remote attackers to bypass the Discord user allowlist by exploiting a logic flaw in the `DiscordAdapter._is_allowed_user` function within `gateway/platforms/discord.py`. Exploitation is rated high complexity (CVSS 4.0 AC:H), resulting in limited but confirmed confidentiality, integrity, and availability impact against the vulnerable system. A public proof-of-concept exploit has been disclosed via GitHub Gist; no vendor patch exists as the vendor did not respond to responsible disclosure.

LOW

2.9

0.4%

35

PoC No patch

CVE-2026-85105

Authorization bypass in NousResearch hermes-agent 0.18.0 allows unauthenticated remote attackers to manipulate the `session_id` argument passed to the `_sess_nowait` function in `s71.py`, circumventing session-based access controls without supplying valid credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivially network-reachable exploitation with no prerequisites, though impact is bounded at low across confidentiality, integrity, and availability, yielding a CVSS 4.0 score of 6.9. No vendor patch exists; NousResearch did not respond to the reporter's disclosure, and no public exploit code has been identified at time of analysis.

MEDIUM

6.9

0.4%

34

No patch

CVE-2026-18775

Server-side request forgery in NousResearch hermes-agent up to version 0.16.0 allows low-privileged remote attackers to manipulate the server into issuing arbitrary HTTP requests via the browser_snapshot function in tools/browser_tool.py. Exploitation can expose internal network services, cloud provider metadata endpoints, and other non-public resources reachable from the server. A public proof-of-concept exploit has been disclosed; the vendor did not respond to coordinated disclosure.

LOW

2.1

0.3%

31

PoC No patch

CVE-2026-84288

Denial of service in NousResearch hermes-agent affects the HermesACPAgent.prompt function within acp_adapter/session.py, exploitable by low-privileged remote users through the ACP Prompt Workflow interface. Versions up to and including 0.18.2 are confirmed affected, with no vendor patch issued following pre-disclosure contact. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation against exposed deployments.

LOW

2.1

0.3%

31

PoC No patch

CVE-2026-84289

Uncontrolled memory allocation in NousResearch hermes-agent up to 0.18.2 allows a low-privileged remote attacker to exhaust memory resources by manipulating input to the list_tools function within the MCP Tool component (tools/mcp_tool.py). The vulnerability is a denial-of-service class issue (CWE-789) with low availability impact per the CVSS 4.0 vector, and a public proof-of-concept report describing resource amplification behavior has been published on GitHub. No vendor patch exists, as the vendor did not respond to coordinated disclosure.

LOW

2.1

0.3%

31

PoC No patch

CVE-2026-14625

Protection mechanism failure in NousResearch hermes-agent (≤ 0.15.2) allows remote authenticated attackers to bypass shell execution controls via the shell.exec function in tui_gateway/server.py, resulting in low-level confidentiality, integrity, and availability impact. The vulnerability is classified under CWE-693 and carries a CVSS 4.0 score of 5.3 (Medium), with a publicly available proof-of-concept exploit hosted on GitHub. No patch has been issued - the vendor did not respond to the researcher's disclosure - meaning all deployments of hermes-agent up to and including version 0.15.2 remain exposed.

LOW

2.1

0.2%

31

PoC No patch

CVE-2026-18993

Improper access control in NousResearch hermes-agent up to 0.16.0 allows low-privileged authenticated users to invoke the Memory Toolset even when it has been explicitly disabled by an operator via the `disabled_toolsets` configuration. The root cause is a missing guard in `init_agent()` within `agent/agent_init.py`, which unconditionally injected the Memory Toolset regardless of operator-level restrictions. A public proof-of-concept exploit exists (GitHub issue #48181), and a vendor patch is available via pull request #46185.

LOW

2.1

0.2%

31

PoC

CVE-2026-18976

Incorrect privilege assignment in NousResearch hermes-agent through 0.16.0 allows authenticated remote users to invoke toolsets that administrators have explicitly disabled via the disabled_toolsets configuration. The flaw resides in get_tool_definitions within agent/agent_init.py, where the disabled_toolsets list was not checked before injecting tool definitions into an agent session, causing disabled tools (e.g., 'memory') to remain fully accessible. No active exploitation is confirmed (not in CISA KEV), but a public proof-of-concept exists via GitHub issue #46171 and an upstream fix is available in PR #46185.

LOW

2.1

0.2%

31

PoC

CVE-2026-18773

Incorrect authorization in NousResearch hermes-agent's Quick Command Handler allows low-privileged remote attackers to bypass slash command access controls via a flaw in the `_check_slash_access` function within `gateway/run.py`. All versions through 2026.6.5 are confirmed affected, with a public proof-of-concept exploit available on GitHub. The vendor did not respond to responsible disclosure, leaving no official patch available at time of analysis.

LOW

2.1

0.2%

31

PoC No patch

CVE-2026-18774

Server-side request forgery in NousResearch hermes-agent through version 0.16.0 allows authenticated remote attackers to coerce the server into making arbitrary outbound HTTP requests by supplying a crafted URL to the xAI Image Generation Provider component. The vulnerability resides in the save_url_image function within agent/image_gen_provider.py, which fails to validate or restrict URLs before fetching them server-side. A proof-of-concept exploit has been publicly disclosed on GitHub; no vendor patch exists as the vendor did not respond to disclosure outreach.

LOW

2.1

0.2%

31

PoC No patch

CVE-2026-15311

Cross-site scripting in NousResearch hermes-agent (all versions through 2026.5.29.2) stems from unsanitized markdown-to-HTML conversion in the Matrix Adapter component, allowing an authenticated remote attacker to inject malicious scripts into Matrix platform messages. When a victim views the crafted content, the injected script executes in their browser context. Publicly available exploit code exists (GitHub issue #42667), though no public exploit identified at time of analysis maps to confirmed active exploitation - the CVSS 4.0 score of 2.0 reflects the low severity, limited scope, and required victim interaction.

LOW

2.0

0.2%

30

PoC

Severity Breakdown

Monthly CVE Trend

Affected Products (2)

Top Risky CVEs