This vulnerability in NousResearch hermes-agent 2026.4.23 affects the _discover_dashboard_plugins function in the hermes_cli/web_server.py file. An attacker with local access can manipulate the HERMES_ENABLE_PROJECT_PLUGINS argument, causing an incorrect comparison that may lead to unintended behavior. The issue does not require user interaction and has low attack complexity but limited scope due to the need for local privileges. The vendor has not provided a fix or advisory, and no patch information is available.

The vulnerability allows a local attacker with limited privileges to manipulate plugin discovery logic in the CLI web-dashboard interface, potentially leading to unauthorized plugin activation or other unintended effects. The CVSS 4.8 score reflects a medium impact with limited attack vector (local) and privileges required. There is no evidence of remote exploitation or widespread active exploitation at this time.

No official fix or patch is currently available from the vendor. Since exploitation requires local access, restricting local user privileges and access to the affected system can reduce risk. Monitor for updates from the vendor for any forthcoming patches or advisories. Avoid running the affected version in untrusted local environments until a fix is released.