NousResearch vulnerabilities and threats

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Management. This manipulation of the argument session_id causes authorization bypass. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the component MCP Tool. Performing a manipulation results in uncontrolled memory allocation. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_adapter/session.py of the component ACP Prompt Workflow. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/api_server.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Hermes Agent versions prior to 0.19.0 contain a supply chain vulnerability in their bundled MCP catalog. This flaw allows remote attackers to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch instead of a pinned commit SHA. Exploitation requires no further operator action once the malicious code is propagated through the affected catalog entry.

Hermes Agent versions 0.16.0 up to but not including 0.17.0 contain a vulnerability where attackers can bypass path restrictions to overwrite the credential store file auth.json. This improper path restriction allows crafted messages to direct file-write operations to sensitive files, enabling credential tampering or unauthorized access. The vulnerability has a high severity score of 7.6 and requires user interaction but no privileges. No official patch or remediation guidance is currently confirmed.

CVE-2026-18993 is a medium severity vulnerability in NousResearch hermes-agent up to version 0.16.0. It involves improper access controls in the Memory Toolset component, specifically in the hermes-agent/model_tools.py file. The vulnerability allows remote attackers to exploit the issue without user interaction or elevated privileges. Exploit code is publicly available, but no official patch or remediation guidance has been provided yet.

CVE-2026-18976 is a medium severity vulnerability in NousResearch hermes-agent up to version 0.16.0. It involves incorrect privilege assignment in the get_tool_definitions function within the disabled_toolsets Handler. The vulnerability can be exploited remotely without user interaction. Public exploit details have been disclosed. No official patch or remediation guidance is currently available.

CVE-2026-18775 is a server-side request forgery (SSRF) vulnerability in the NousResearch hermes-agent up to version 0.16.0. It affects the browser_snapshot function in the tools/browser_tool.py component. The vulnerability allows remote attackers to manipulate server requests. The vendor has not responded to disclosure attempts, and no official patch or remediation is currently available. The CVSS 4.0 score rates this vulnerability as medium severity.

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-18773 is a medium severity vulnerability in NousResearch hermes-agent up to version 2026.6.5. It involves incorrect authorization in the _check_slash_access function within the Quick Command Handler component. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, and the vendor has not responded to disclosure attempts. No official patch or remediation guidance is currently available.

CVE-2026-17432 is a low-severity vulnerability in NousResearch hermes-agent version 2026.6.5 involving improper access controls in the SimpleX Gateway Authorization component. The issue arises from manipulation of the contactId argument in the file hermes-agent/plugins/platforms/simplex/adapter.py. Exploitation requires high complexity and no privileges, but the exploit is publicly available. A patch identified by commit 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3 is advised to resolve the issue.

A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter._markdown_to_html of the file gateway/platforms/matrix.py of the component Matrix Adapter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.

A vulnerability was determined in NousResearch hermes-agent 2026.5.29.2. The impacted element is the function skill_view of the file tools/skills_tool.py. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 56f833efa427ccb444c0f9ad1759af1012f2124d. It is advisable to implement a patch to correct this issue.

A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16. This impacts the function extract_media of the file gateway/platforms/base.py of the component Live Webhook Endpoint. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects the function DiscordAdapter._is_allowed_user of the file gateway/platforms/discord.py of the component Discord Platform Integration. Such manipulation leads to improper authentication. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation of the file run_agent.py of the component HTTP API. This manipulation of the argument todos causes denial of service. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.