Threats affecting pkg:github/nousresearch/hermes-agent

CVE-2026-114463 is an authorization vulnerability in the webhook platform gateway of Nous Research Hermes Agent. The agent constructs session chat IDs using a string format that includes the route name. If the route name contains a colon character, the authorization logic incorrectly resolves to a higher-privileged route than intended. This flaw allows a remote attacker who possesses the target HMAC to gain access to toolsets associated with a more privileged route than they are authorized for.

CVE-2026-18993 is a medium severity vulnerability in NousResearch hermes-agent up to version 0.16.0. It involves improper access controls in the Memory Toolset component, specifically in the hermes-agent/model_tools.py file. The vulnerability allows remote attackers to exploit the issue without user interaction or elevated privileges. Exploit code is publicly available, but no official patch or remediation guidance has been provided yet.

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-18773 is a medium severity vulnerability in NousResearch hermes-agent up to version 2026.6.5. It involves incorrect authorization in the _check_slash_access function within the Quick Command Handler component. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, and the vendor has not responded to disclosure attempts. No official patch or remediation guidance is currently available.

CVE-2026-17432 is a low-severity vulnerability in NousResearch hermes-agent version 2026.6.5 involving improper access controls in the SimpleX Gateway Authorization component. The issue arises from manipulation of the contactId argument in the file hermes-agent/plugins/platforms/simplex/adapter.py. Exploitation requires high complexity and no privileges, but the exploit is publicly available. A patch identified by commit 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3 is advised to resolve the issue.

A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter._markdown_to_html of the file gateway/platforms/matrix.py of the component Matrix Adapter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.

A vulnerability was determined in NousResearch hermes-agent 2026.5.29.2. The impacted element is the function skill_view of the file tools/skills_tool.py. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 56f833efa427ccb444c0f9ad1759af1012f2124d. It is advisable to implement a patch to correct this issue.

A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects the function DiscordAdapter._is_allowed_user of the file gateway/platforms/discord.py of the component Discord Platform Integration. Such manipulation leads to improper authentication. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gateway/stream_consumer.py of the component Streaming Reasoning Tag Filter. The manipulation leads to improper handling of case sensitivity. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project decided to not implement a dedicated fix: "[T]he analysis and the fix are both sound. It just lands below the bar for the maintenance cost of a duplicated scrub path."

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.23. This affects the function _sync_anthropic_entry_from_credentials_file of the file agent/credential_pool.py of the component Credential Pool Synchronization. The manipulation results in improper authentication. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function _handle_webhook_request of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function _serve_plugin_skill/skill_view of the file tools/skills_tool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-9369 is a medium severity vulnerability in NousResearch hermes-agent version 2026.4.23. It involves an incorrect comparison in the _discover_dashboard_plugins function within the hermes_cli/web_server.py file. The flaw can be triggered by manipulating the HERMES_ENABLE_PROJECT_PLUGINS argument. Exploitation requires local access, and no vendor response or patch is currently available.

CVE-2026-9368 is a medium severity vulnerability in NousResearch hermes-agent up to version 2026.4.16. It affects the execute_code function in tools/code_execution_tool.py within the Environment Variable Handler component, leading to a sandbox issue. The vulnerability can be exploited remotely and a public exploit is available. The vendor has not responded to disclosure and no official fix or patch is currently known.

CVE-2026-9366 is a medium severity injection vulnerability in the NousResearch hermes-agent version 2026.4.23. The issue exists in the _scan_context_content function within the agent/prompt_builder.py file. This vulnerability allows remote attackers to perform injection attacks. The exploit code has been publicly disclosed. The vendor has not responded or provided a fix at the time of this report.

A vulnerability was detected in NousResearch hermes-agent up to 2026.4.16. The affected element is an unknown function of the component Slack Agent/Mattermost Agent. The manipulation of the argument format_message results in escaping of output. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-9353 is a medium severity injection vulnerability in NousResearch hermes-agent versions 2026.4.0 through 2026.4.23. It affects an unknown function in the file agent/skills_guard.py related to the Skills Guard Multi-Word Prompt Handler component. The vulnerability arises from manipulation of the THREAT_PATTERNS argument, allowing injection. Remote exploitation is possible, and a public exploit has been disclosed. The vendor has not responded to the disclosure and no patch or remediation is currently available.

A weakness has been identified in NousResearch hermes-agent up to 2026.4.23. This issue affects the function _make_run_env of the file tools/environments/local.py of the component Messaging Gateway Handler. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This affects the function check_all_command_guards of the file tools/approval.py of the component Batch Runner. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-7397 is a medium severity vulnerability in NousResearch hermes-agent version 0.8.0 involving symlink following due to a flaw in the _check_sensitive_path function in tools/file_tools.py. The issue requires local attacker privileges and does not involve user interaction. Exploit code has been publicly released. Upgrading to version 0.9.0 mitigates the vulnerability.