The NousResearch hermes-agent 2026.5.29.2 contains a path traversal vulnerability in the skill_view function located in tools/skills_tool.py. An attacker can remotely manipulate the argument Name to traverse directories and potentially access unauthorized files. This vulnerability has been publicly disclosed, and a patch exists as indicated by the referenced commit. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation allows a remote attacker to perform path traversal via the Name argument in the skill_view function, potentially leading to unauthorized access to files on the affected system. The vulnerability does not require privileges or user interaction, increasing its risk. However, the impact is limited to information disclosure or file access as indicated by the vulnerability type and CVSS vector.

A patch identified by commit 56f833efa427ccb444c0f9ad1759af1012f2124d is available and should be applied to remediate this vulnerability. Since the vendor advisory or patch details are not explicitly provided, it is recommended to obtain and apply the official patch from NousResearch or the hermes-agent project repository. Patch status is not yet confirmed in the advisory; verify with the vendor for current remediation guidance.