This vulnerability affects the shell.exec function in the tui_gateway/server.py file of NousResearch hermes-agent up to version 0.15.2. It results in a protection mechanism failure that can be triggered remotely, potentially allowing unauthorized command execution or similar impacts. The vendor was notified but has not provided any remediation or acknowledgment. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low attack complexity, and no user interaction required.

The vulnerability allows remote attackers to bypass protection mechanisms in the affected function, potentially leading to unauthorized command execution or other security breaches. The exploit is publicly available, increasing the risk of exploitation. However, there is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying workarounds such as disabling or restricting access to the vulnerable functionality if possible, and monitor for updates from the vendor.