Nousresearch Hermes Agent
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Nousresearch Hermes Agent.
By the Year
In 2026 there have been 40 vulnerabilities in Nousresearch Hermes Agent with an average score of 6.0 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 40 | 6.04 |
It may take a day or so for new Hermes Agent vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Nousresearch Hermes Agent Security Vulnerabilities
RCE in Hermes Agent 0.18.2-0.21.0 via crafted .git/config core.fsmonitor
CVE-2026-71963
8.6 - High
- September 03, 2026
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.
Shell injection
Hermes-Agent 0.18.0 Resource Buffer Exploit via Electron Main Process
CVE-2026-85107
5.3 - Medium
- September 03, 2026
A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().
Allocation of Resources Without Limits or Throttling
SSRF in NousResearch hermes-agent 0.18.0 Link Title Fetch
CVE-2026-85106
5.3 - Medium
- September 03, 2026
A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
SSRF
Authorization Bypass in NousResearch Hermes-Agent 0.18.0 Session Management
CVE-2026-85105
6.9 - Medium
- September 03, 2026
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Management. This manipulation of the argument session_id causes authorization bypass. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Insecure Direct Object Reference / IDOR
Uncontrolled Memory Allocation in NousResearch hermes-agent 0.18.2 MCP Tool
CVE-2026-84289
5.3 - Medium
- September 01, 2026
A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the component MCP Tool. Performing a manipulation results in uncontrolled memory allocation. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Stack Exhaustion
DoS in NousResearch hermes-agent <0.18.2 via HermACPA prompt
CVE-2026-84288
5.3 - Medium
- September 01, 2026
A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_adapter/session.py of the component ACP Prompt Workflow. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Improper Resource Shutdown or Release
Denial of Service in NousResearch hermes-agent 0.18.0 Session Chat Interface
CVE-2026-84287
5.3 - Medium
- September 01, 2026
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/api_server.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Improper Resource Shutdown or Release
Hermes Agent <0.19.0 Remote Code Exec via Mutable MCP Catalog Branch
CVE-2026-82021
9 - Critical
- August 28, 2026
Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalog entry, with no further action required by the operator.
Download of Code Without Integrity Check
Hermes Agent 0.16.0 Improper Path Restriction Allows Credential Store Overwrite
CVE-2026-82020
7.6 - High
- August 28, 2026
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages directing the agent's file-write tooling to overwrite the credential store without triggering any path-based protection, enabling credential tampering or unauthorized access.
Files or Directories Accessible to External Parties
NousResearch hermes-agent <=0.16.0 Improper Access via Memory Toolset
CVE-2026-18993
5.3 - Medium
- August 06, 2026
A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_tools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used.
Authorization
NousResearch hermes-agent <0.16.0: Misprivilege via disabled_toolsets
CVE-2026-18976
5.3 - Medium
- August 06, 2026
A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the component disabled_toolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.
Incorrect Privilege Assignment
SSRF via Browser Tooling in NousResearch hermes-agent v0.16.0
CVE-2026-18775
5.3 - Medium
- August 04, 2026
A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser_snapshot of the file tools/browser_tool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
SSRF
SSRF in NousResearch Hermes-Agent xAI before 0.16.0
CVE-2026-18774
5.3 - Medium
- August 04, 2026
A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
SSRF
NousR hermes-agent <=2026.6.5: Auth bypass via _check_slash_access QuickCmd
CVE-2026-18773
5.3 - Medium
- August 04, 2026
A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py of the component Quick Command Handler. The manipulation results in incorrect authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AuthZ
NousResearch Hermes-Agent 2026.6.5 Improper Access Control in SimpleX Auth
CVE-2026-17432
5 - Medium
- July 26, 2026
A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improper access controls. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit is now public and may be used. The patch is identified as 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3. Applying a patch is advised to resolve this issue.
Authorization
NousResearch Hermes-Agent MatrixAdapter XSS via _markdown_to_html (2026.5.29.2)
CVE-2026-15311
3.5 - Low
- July 09, 2026
A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter._markdown_to_html of the file gateway/platforms/matrix.py of the component Matrix Adapter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
XSS
NousResearch hermes-agent 2026.5.29.2 Path Traversal via skill_view
CVE-2026-14783
4.3 - Medium
- July 05, 2026
A vulnerability was determined in NousResearch hermes-agent 2026.5.29.2. The impacted element is the function skill_view of the file tools/skills_tool.py. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 56f833efa427ccb444c0f9ad1759af1012f2124d. It is advisable to implement a patch to correct this issue.
Directory traversal
NousResearch Hermes-Agent <=2026.5.16 Path Traversal in Live Webhook Endpoint
CVE-2026-14628
5.3 - Medium
- July 04, 2026
A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16. This impacts the function extract_media of the file gateway/platforms/base.py of the component Live Webhook Endpoint. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Directory traversal
Remote Auth Bypass in NousResearch Hermes Agent 0.15.2 (DiscordAdapter)
CVE-2026-14627
5.6 - Medium
- July 04, 2026
A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects the function DiscordAdapter._is_allowed_user of the file gateway/platforms/discord.py of the component Discord Platform Integration. Such manipulation leads to improper authentication. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
authentification
Denial of Service via HTTP API in NousResearch hermes-agent <=2026.4.30
CVE-2026-14626
4.3 - Medium
- July 04, 2026
A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation of the file run_agent.py of the component HTTP API. This manipulation of the argument todos causes denial of service. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Improper Resource Shutdown or Release
NousResearch Hermes-Agent Remote Shell Exec Vulnerability up to 0.15.2
CVE-2026-14625
6.3 - Medium
- July 04, 2026
A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element is the function shell.exec of the file tui_gateway/server.py. The manipulation results in protection mechanism failure. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Protection Mechanism Failure
Hermes-agent 2026.4.30: SR Tag Filter Case-Sensitivity Remote CVE-2026-14617
CVE-2026-14617
3.1 - Low
- July 03, 2026
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gateway/stream_consumer.py of the component Streaming Reasoning Tag Filter. The manipulation leads to improper handling of case sensitivity. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project decided to not implement a dedicated fix: "[T]he analysis and the fix are both sound. It just lands below the bar for the maintenance cost of a duplicated scrub path."
Improper Handling of Case Sensitivity
Hermes Agent <0.16.0 Exposes Sensitive Files via 0o644 Permissions
CVE-2026-53870
6.8 - Medium
- June 17, 2026
Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including conversation history, tool payloads, prompts, and per-route HMAC secrets.
Incorrect Default Permissions
Hermes Agent <0.16.0 DNS Rebinding via WebSocket FastAPI Middleware Bypass
CVE-2026-53869
8.7 - High
- June 17, 2026
Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling attackers to exploit DNS rebinding and inject malicious commands or read terminal output.
Missing Authentication for Critical Function
NousResearch Hermès Agent <=0.12.0 Auth Bypass via resume Endpoint Title Param
CVE-2026-11461
6.3 - Medium
- June 07, 2026
A vulnerability has been found in NousResearch hermes-agent up to 0.12.0. This affects the function resolve_session_by_title of the file hermes_state.py of the component resume Endpoint. Such manipulation of the argument Title leads to authorization bypass. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Insecure Direct Object Reference / IDOR
NousResearch hermes-agent <= 2026.4.23: CredentialPool Improper Auth Bypass
CVE-2026-10548
5.3 - Medium
- June 02, 2026
A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.23. This affects the function _sync_anthropic_entry_from_credentials_file of the file agent/credential_pool.py of the component Credential Pool Synchronization. The manipulation results in improper authentication. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
authentification
NousResearch hermes-agent <= 2026.4.30 - Webhook Resource Exhaustion
CVE-2026-10224
5.3 - Medium
- June 01, 2026
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function _handle_webhook_request of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Resource Exhaustion
Hermes-agent memory injection via _scan_memory_content <= 2026.4.30
CVE-2026-10223
6.3 - Medium
- June 01, 2026
A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. This affects the function _scan_memory_content of the file tools/memory_tool.py. This manipulation causes injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Injection
NousResearch Hermes-Agent 2026.4.30 RCE via _sanitize_env_lines
CVE-2026-10222
5.6 - Medium
- June 01, 2026
A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.30. Affected by this issue is the function _sanitize_env_lines of the file hermes_cli/config.py. The manipulation results in injection. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Injection
Hermes-Agent <=0.12.0 RCE via _compress_context
CVE-2026-10221
7.3 - High
- June 01, 2026
A vulnerability was identified in NousResearch hermes-agent up to 0.12.0. Affected by this vulnerability is the function _compress_context of the file run_agent.py. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Injection
NousResearch hermes-agent <=2026.4.30 Remote Injection via skills_tool.py
CVE-2026-10220
7.3 - High
- June 01, 2026
A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function _serve_plugin_skill/skill_view of the file tools/skills_tool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Injection
NousResearch hermes-agent 2026.4.23: Local CLI Web-Dashboard Arg Compare
CVE-2026-9369
5.3 - Medium
- May 24, 2026
A security flaw has been discovered in NousResearch hermes-agent 2026.4.23. Affected is the function _discover_dashboard_plugins of the file hermes_cli/web_server.py of the component CLI web-dashboard Interface. Performing a manipulation of the argument HERMES_ENABLE_PROJECT_PLUGINS results in incorrect comparison. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Incorrect Comparison
Sandbox Escape in NousResearch Hermes Agent <=2026.4.16 via EnvVar Handler
CVE-2026-9368
7.3 - High
- May 24, 2026
A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Environment Variable Handler. Such manipulation leads to sandbox issue. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Privilege Issues
OS Command Injection in Hermes-Agent terminal_tool
CVE-2026-9367
7.3 - High
- May 24, 2026
A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect_dangerous_command of the file tools/approval.py of the component terminal_tool. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Shell injection
Remote Injection via prompt_builder.py in NousResearch Hermes-agent 2026.4.23
CVE-2026-9366
7.3 - High
- May 24, 2026
A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function _scan_context_content of the file agent/prompt_builder.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Injection
NousResearch hermes-agent <=2026.4.16 Remote Output Escaping Slack/Mattermost
CVE-2026-9354
6.5 - Medium
- May 24, 2026
A vulnerability was detected in NousResearch hermes-agent up to 2026.4.16. The affected element is an unknown function of the component Slack Agent/Mattermost Agent. The manipulation of the argument format_message results in escaping of output. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Output Sanitization
NousResearch hermes-agent <2026.4.23: SG MW Prompt THREAT_PATTERNS injection
CVE-2026-9353
7.3 - High
- May 24, 2026
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.23. Impacted is an unknown function of the file agent/skills_guard.py of the component Skills Guard Multi-Word Prompt Handler. The manipulation of the argument THREAT_PATTERNS leads to injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Injection
Information Disclosure in NousResearch hermes-agent 2026.4.23 (Messaging Gateway Handler)
CVE-2026-9352
5.3 - Medium
- May 24, 2026
A weakness has been identified in NousResearch hermes-agent up to 2026.4.23. This issue affects the function _make_run_env of the file tools/environments/local.py of the component Messaging Gateway Handler. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Information Disclosure
NousResearch hermes-agent 2026.4.16 path traversal in read_file Tool
CVE-2026-9351
6.5 - Medium
- May 24, 2026
A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.16. This vulnerability affects the function _is_blocked_device of the file tools/file_tools.py of the component read_file Tool. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Directory traversal
Missing Auth in Batch Runner of NousResearch Hermes-Agent 2026.4.16
CVE-2026-9350
7.3 - High
- May 24, 2026
A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This affects the function check_all_command_guards of the file tools/approval.py of the component Batch Runner. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AuthZ
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Nousresearch Hermes Agent or by Nousresearch? Click the Watch button to subscribe.
