CVE-2026-18993

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions, exposing conversation history and HMAC secrets to local users.

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalog entry, with no further action required by the operator.

Hermes Agent versions 0.16.0 through prior to 0.17.0 contain an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages directing the agent's file-write tooling to overwrite the credential store without triggering any path-based protection, enabling credential tampering or unauthorized access.

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. It impacts the function get_tool_definitions in the file agent/agent_init.py of the disabled_toolsets Handler component. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0, affecting the browser_snapshot function in tools/browser_tool.py of the Browser Tooling component. This flaw allows server-side request forgery (SSRF) and can be exploited remotely. The exploit has been publicly disclosed.

A flaw has been found in NousResearch hermes-agent up to version 0.16.0 in the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely, and the exploit has been published.

In NousResearch hermes-agent version 2026.6.5, a vulnerability was detected in an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py in the SimpleX Gateway Authorization component. Manipulation of the contactId argument results in improper access controls. The attack can be launched remotely but is difficult to exploit (high complexity). The exploit is public. A patch is available with ID 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3.

A path traversal vulnerability was found in hermes-agent version 2026.5.29.2 in the skill_view function of tools/skills_tool.py. An attacker can remotely manipulate the Name argument, leading to unauthorized file access. The exploit has been publicly disclosed and may be used.

A path traversal vulnerability was found in the Live Webhook Endpoint component of NousResearch hermes-agent up to version 2026.5.16. The extract_media function in gateway/platforms/base.py allows path manipulation, enabling remote attacks.

A weakness has been identified in NousResearch hermes-agent up to version 2026.4.30 in the function AIAgent.run_conversation of the file run_agent.py of the HTTP API component. Manipulation of the argument todos causes denial of service. The attack can be initiated remotely, and the exploit is publicly available.