This vulnerability in NousResearch hermes-agent (versions up to 0.16.0) involves the save_url_image function in agent/image_gen_provider.py, which is part of the xAI Image Generation Provider component. The flaw enables server-side request forgery, allowing an attacker to cause the server to make unintended requests. The vulnerability can be exploited remotely without user interaction and requires low privileges. Although exploit code is publicly available, there is no official vendor response or patch at this time.

Successful exploitation of this SSRF vulnerability could allow an attacker to make arbitrary requests from the affected server, potentially accessing internal resources or services not otherwise reachable. The impact is rated medium based on the CVSS score of 5.3, reflecting limited privileges required and low complexity of attack, but with limited scope and impact as indicated by the vector metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider implementing network-level restrictions to limit outbound requests from the affected component and review usage of the save_url_image function to mitigate potential exploitation.