hermes-agent vulnerabilities

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions, exposing conversation history and HMAC secrets to local users.

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalog entry, with no further action required by the operator.

Hermes Agent versions 0.16.0 through prior to 0.17.0 contain an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages directing the agent's file-write tooling to overwrite the credential store without triggering any path-based protection, enabling credential tampering or unauthorized access.

A vulnerability was detected in NousResearch hermes-agent up to 0.16.0, affecting some unknown functionality in the file hermes-agent/model_tools.py in the Memory Toolset component. The manipulation results in improper access controls. The attack can be executed remotely, and the exploit is now public.

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. It impacts the function get_tool_definitions in the file agent/agent_init.py of the disabled_toolsets Handler component. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0, affecting the browser_snapshot function in tools/browser_tool.py of the Browser Tooling component. This flaw allows server-side request forgery (SSRF) and can be exploited remotely. The exploit has been publicly disclosed.

A flaw has been found in NousResearch hermes-agent up to version 0.16.0 in the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely, and the exploit has been published.

In NousResearch hermes-agent version 2026.6.5, a vulnerability was detected in an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py in the SimpleX Gateway Authorization component. Manipulation of the contactId argument results in improper access controls. The attack can be launched remotely but is difficult to exploit (high complexity). The exploit is public. A patch is available with ID 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3.

A path traversal vulnerability was found in hermes-agent version 2026.5.29.2 in the skill_view function of tools/skills_tool.py. An attacker can remotely manipulate the Name argument, leading to unauthorized file access. The exploit has been publicly disclosed and may be used.

A path traversal vulnerability was found in the Live Webhook Endpoint component of NousResearch hermes-agent up to version 2026.5.16. The extract_media function in gateway/platforms/base.py allows path manipulation, enabling remote attacks.

A weakness has been identified in NousResearch hermes-agent up to version 2026.4.30 in the function AIAgent.run_conversation of the file run_agent.py of the HTTP API component. Manipulation of the argument todos causes denial of service. The attack can be initiated remotely, and the exploit is publicly available.

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on specified endpoints, enabling attackers to exploit this vulnerability.

NousResearch hermes-agent up to version 0.12.0 is vulnerable to authorization bypass in the resolve_session_by_title function. Manipulating the Title argument allows remote attackers to bypass authorization.

NousResearch hermes-agent up to version 2026.4.23 has a vulnerability in the _sync_anthropic_entry_from_credentials_file function in agent/credential_pool.py, leading to improper authentication. The attack requires local access.

A weakness was identified in NousResearch hermes-agent up to version 2026.4.30 in the function _scan_memory_content of file tools/memory_tool.py, allowing remote injection. The exploit has been made public and could be used for attacks. The vendor did not respond.

In NousResearch hermes-agent up to version 2026.4.30, an injection vulnerability exists in the _sanitize_env_lines function of hermes_cli/config.py. The attack can be launched remotely but requires high complexity. The exploit has been publicly released.

In NousResearch hermes-agent up to version 0.12.0, an injection vulnerability exists in the _compress_context function of run_agent.py. The attack can be performed remotely and the exploit is publicly available.

In NousResearch hermes-agent up to version 2026.4.30, an injection vulnerability exists in the _serve_plugin_skill/skill_view function of tools/skills_tool.py. The attack can be performed remotely and the exploit is publicly available.

In NousResearch hermes-agent version 2026.4.23, a flaw was found in the _discover_dashboard_plugins function of the hermes_cli/web_server.py file. Manipulation of the HERMES_ENABLE_PROJECT_PLUGINS argument leads to incorrect comparison. The attack requires local access and the exploit has been published.

Vulnerability due to improper output escaping in the format_message function in Slack Agent/Mattermost Agent in hermes-agent. Manipulation of the format_message argument allows code injection.

A path traversal vulnerability exists in NousResearch hermes-agent up to version 2026.4.16 in the _is_blocked_device function of the read_file Tool component. Remote exploitation is possible and the exploit has been released.

NousResearch hermes-agent up to version 2026.4.16 is vulnerable to missing authorization in the function check_all_command_guards in the file tools/approval.py of the Batch Runner component. The attack can be launched remotely.