The vulnerability CVE-2026-9351 involves a path traversal issue in the _is_blocked_device function of the file_tools.py script in the hermes-agent product by NousResearch. This allows an attacker to manipulate file paths remotely, potentially accessing unauthorized files. The affected versions range from 2026.4.0 through 2026.4.16. The vulnerability requires no privileges and no user interaction, increasing its risk profile. Despite public disclosure and exploit availability, the vendor has not provided any official fix or mitigation guidance.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to perform path traversal, potentially reading arbitrary files on the affected system. This could lead to unauthorized information disclosure or further attacks depending on the files accessed. The medium CVSS score reflects the moderate impact and ease of exploitation without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing network-level controls to restrict access to the hermes-agent service and monitor for suspicious activity related to file access attempts. Avoid exposing the vulnerable service to untrusted networks until an official patch or mitigation is available.