This vulnerability affects the hermes-agent product from NousResearch, specifically in the Batch Runner component's tools/approval.py file. The check_all_command_guards function lacks proper authorization checks, allowing remote attackers to manipulate commands without required permissions. The CVSS 4.0 base score is 6.9, reflecting network attack vector, no privileges or user interaction needed, and low to limited impact on confidentiality, integrity, and availability. No vendor advisory or patch information is available, and the vendor has not responded to the disclosure.

An unauthenticated remote attacker can exploit this vulnerability to bypass authorization controls in the hermes-agent Batch Runner component. This could lead to unauthorized command execution or manipulation within the affected system. The impact on confidentiality, integrity, and availability is rated as low to limited per the CVSS vector. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider implementing compensating controls such as restricting network access to the hermes-agent service and monitoring for suspicious activity related to command execution. Stay alert for any future vendor advisories or patches.