CVE-2026-10223

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the component MCP Tool. Performing a manipulation results in uncontrolled memory allocation. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in NousResearch hermes-agent up to version 0.18.2, affecting the HermesACPAgent.prompt function in acp_adapter/session.py of the ACP Prompt Workflow component. Manipulation leads to denial of service. The attack can be performed remotely, and the exploit has been publicly disclosed.

A flaw has been found in NousResearch hermes-agent 0.18.0, affecting some unknown functionality of the file gateway/platforms/api_server.py of the Session Chat Interface component. This manipulation causes denial of service. The attack can be carried out remotely, and the exploit has been published and may be used. The vendor was contacted early but did not respond.

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalog entry, with no further action required by the operator.

Hermes Agent versions 0.16.0 through prior to 0.17.0 contain an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages directing the agent's file-write tooling to overwrite the credential store without triggering any path-based protection, enabling credential tampering or unauthorized access.

A vulnerability was detected in NousResearch hermes-agent up to 0.16.0, affecting some unknown functionality in the file hermes-agent/model_tools.py in the Memory Toolset component. The manipulation results in improper access controls. The attack can be executed remotely, and the exploit is now public.

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. It impacts the function get_tool_definitions in the file agent/agent_init.py of the disabled_toolsets Handler component. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely, and the exploit has been publicly disclosed.