CVE-2026-85107: Allocation of Resources in NousResearch hermes-agent
Description
A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().
CVSS v4.0
Score 5.3medium
Affected software
NousResearch
hermes-agent
cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the resourceBufferFromUrl function in the apps/desktop/electron/main.ts file of the hermes-agent 0.18.0. An attacker can remotely manipulate this function to cause resource allocation, potentially leading to resource exhaustion or related impacts. The older entry point copyImageFromUrl() was removed in versions after v2026.8.3, replaced by a more secure Electron-native event.sender.copyImageAt() method, indicating that the vulnerability is limited to older versions such as 0.18.0.
Potential Impact
The vulnerability allows remote attackers to cause allocation of resources via manipulation of the resourceBufferFromUrl function. This could lead to resource exhaustion or degraded performance on affected systems. There is no indication of privilege escalation, confidentiality, or integrity impact. No known exploits are reported in the wild.
Mitigation Recommendations
No official patch or remediation level has been published yet. Users should upgrade to versions later than 0.18.0 or versions where the copyImageFromUrl() function has been removed (post v2026.8.3) to avoid this vulnerability. Monitor vendor advisories for official fixes or updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-03T06:47:17.090Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a99711eacd9273b49f4056c
Added to database: 09/03/2026, 13:07:42 UTC
Last enriched: 09/07/2026, 13:13:44 UTC
Last updated: 10/17/2026, 18:48:23 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.