hermes-agent vulnerabilities

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the component MCP Tool. Performing a manipulation results in uncontrolled memory allocation. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in NousResearch hermes-agent up to version 0.18.2, affecting the HermesACPAgent.prompt function in acp_adapter/session.py of the ACP Prompt Workflow component. Manipulation leads to denial of service. The attack can be performed remotely, and the exploit has been publicly disclosed.

A flaw has been found in NousResearch hermes-agent 0.18.0, affecting some unknown functionality of the file gateway/platforms/api_server.py of the Session Chat Interface component. This manipulation causes denial of service. The attack can be carried out remotely, and the exploit has been published and may be used. The vendor was contacted early but did not respond.

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalog entry, with no further action required by the operator.

Hermes Agent versions 0.16.0 through prior to 0.17.0 contain an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages directing the agent's file-write tooling to overwrite the credential store without triggering any path-based protection, enabling credential tampering or unauthorized access.

A vulnerability was detected in NousResearch hermes-agent up to 0.16.0, affecting some unknown functionality in the file hermes-agent/model_tools.py in the Memory Toolset component. The manipulation results in improper access controls. The attack can be executed remotely, and the exploit is now public.

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. It impacts the function get_tool_definitions in the file agent/agent_init.py of the disabled_toolsets Handler component. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely, and the exploit has been publicly disclosed.

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0, affecting the browser_snapshot function in tools/browser_tool.py of the Browser Tooling component. This flaw allows server-side request forgery (SSRF) and can be exploited remotely. The exploit has been publicly disclosed.

A flaw has been found in NousResearch hermes-agent up to version 0.16.0 in the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely, and the exploit has been published.

In NousResearch hermes-agent version 2026.6.5, a vulnerability was detected in an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py in the SimpleX Gateway Authorization component. Manipulation of the contactId argument results in improper access controls. The attack can be launched remotely but is difficult to exploit (high complexity). The exploit is public. A patch is available with ID 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3.

A path traversal vulnerability was found in hermes-agent version 2026.5.29.2 in the skill_view function of tools/skills_tool.py. An attacker can remotely manipulate the Name argument, leading to unauthorized file access. The exploit has been publicly disclosed and may be used.

A path traversal vulnerability was found in the Live Webhook Endpoint component of NousResearch hermes-agent up to version 2026.5.16. The extract_media function in gateway/platforms/base.py allows path manipulation, enabling remote attacks.

A weakness has been identified in NousResearch hermes-agent up to version 2026.4.30 in the function AIAgent.run_conversation of the file run_agent.py of the HTTP API component. Manipulation of the argument todos causes denial of service. The attack can be initiated remotely, and the exploit is publicly available.

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions, exposing conversation history and HMAC secrets to local users.

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on specified endpoints, enabling attackers to exploit this vulnerability.

NousResearch hermes-agent up to version 0.12.0 is vulnerable to authorization bypass in the resolve_session_by_title function. Manipulating the Title argument allows remote attackers to bypass authorization.

NousResearch hermes-agent up to version 2026.4.23 has a vulnerability in the _sync_anthropic_entry_from_credentials_file function in agent/credential_pool.py, leading to improper authentication. The attack requires local access.

A weakness was identified in NousResearch hermes-agent up to version 2026.4.30 in the function _scan_memory_content of file tools/memory_tool.py, allowing remote injection. The exploit has been made public and could be used for attacks. The vendor did not respond.

In NousResearch hermes-agent up to version 2026.4.30, an injection vulnerability exists in the _sanitize_env_lines function of hermes_cli/config.py. The attack can be launched remotely but requires high complexity. The exploit has been publicly released.

In NousResearch hermes-agent up to version 0.12.0, an injection vulnerability exists in the _compress_context function of run_agent.py. The attack can be performed remotely and the exploit is publicly available.

In NousResearch hermes-agent up to version 2026.4.30, an injection vulnerability exists in the _serve_plugin_skill/skill_view function of tools/skills_tool.py. The attack can be performed remotely and the exploit is publicly available.

In NousResearch hermes-agent version 2026.4.23, a flaw was found in the _discover_dashboard_plugins function of the hermes_cli/web_server.py file. Manipulation of the HERMES_ENABLE_PROJECT_PLUGINS argument leads to incorrect comparison. The attack requires local access and the exploit has been published.

Vulnerability due to improper output escaping in the format_message function in Slack Agent/Mattermost Agent in hermes-agent. Manipulation of the format_message argument allows code injection.

A path traversal vulnerability exists in NousResearch hermes-agent up to version 2026.4.16 in the _is_blocked_device function of the read_file Tool component. Remote exploitation is possible and the exploit has been released.

NousResearch hermes-agent up to version 2026.4.16 is vulnerable to missing authorization in the function check_all_command_guards in the file tools/approval.py of the Batch Runner component. The attack can be launched remotely.