CVE-2026-14783
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A path traversal vulnerability was found in hermes-agent version 2026.5.29.2 in the skill_view function of tools/skills_tool.py. An attacker can remotely manipulate the Name argument, leading to unauthorized file access. The exploit has been publicly disclosed and may be used.
Risk Assessment
The risk involves potential remote reading or writing of files outside the intended directory, which could lead to data leakage or system compromise.
Recommendation
Immediately apply the patch identified as 56f833efa427ccb444c0f9ad1759af1012f2124d to fix the vulnerability.
Original NVD description (English source)
A vulnerability was determined in NousResearch hermes-agent 2026.5.29.2. The impacted element is the function skill_view of the file tools/skills_tool.py. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 56f833efa427ccb444c0f9ad1759af1012f2124d. It is advisable to implement a patch to correct this issue.