Skip to contentNousresearch Hermes-agent vulnerabilities
- nousresearch hermes-agentHermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config InjectionCVE-2026-71963Public exploit8.6 High
- nousresearch hermes-agentNousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resourcesCVE-2026-851075.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgeryCVE-2026-851065.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Session Management s71.py _sess_nowait authorizationCVE-2026-851056.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocationCVE-2026-842895.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of serviceCVE-2026-842885.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Session Chat api_server.py denial of serviceCVE-2026-842875.3 Medium
- nousresearch hermes-agentHermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch ReferenceCVE-2026-820219.0 Critical
- nousresearch hermes-agentHermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write ToolCVE-2026-820207.6 High
- nousresearch hermes-agentNousResearch hermes-agent Memory Toolset model_tools.py access controlCVE-2026-189935.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignmentCVE-2026-189765.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgeryCVE-2026-187755.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgeryCVE-2026-187745.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Quick run.py _check_slash_access authorizationCVE-2026-187735.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent SimpleX Gateway Authorization adapter.py access controlCVE-2026-174322.3 Low
- nousresearch hermes-agentNousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scriptingCVE-2026-153115.1 Medium
- nousresearch hermes-agentNousResearch hermes-agent skills_tool.py skill_view path traversalCVE-2026-147835.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversalCVE-2026-14628Public exploit6.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authenticationCVE-2026-146276.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of serviceCVE-2026-146265.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent server.py shell.exec protection mechanismCVE-2026-146255.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivityCVE-2026-146172.3 Low
- nousresearch hermes-agentHermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store FilesCVE-2026-53870Fix available6.8 Medium
- nousresearch hermes-agentHermes Agent < 0.16.0 - DNS Rebinding Bypass via WebSocket EndpointsCVE-2026-53869Fix available8.7 High
- nousresearch hermes-agentNousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorizationCVE-2026-114615.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authenticationCVE-2026-105484.8 Medium
- nousresearch hermes-agentNousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumptionCVE-2026-102246.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent memory_tool.py _scan_memory_content injectionCVE-2026-10223Fix available5.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent config.py _sanitize_env_lines injectionCVE-2026-10222Fix available6.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent run_agent.py _compress_context injectionCVE-2026-102216.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent skills_tool.py skill_view injectionCVE-2026-102206.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent CLI web-dashboard web_server.py _discover_dashboard_plugins comparisonCVE-2026-9369Fix available4.8 Medium
- nousresearch hermes-agentNousResearch hermes-agent Environment Variable code_execution_tool.py execute_code sandboxCVE-2026-9368Fix available6.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injectionCVE-2026-93676.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent prompt_builder.py _scan_context_content injectionCVE-2026-9366Fix available6.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent Slack Agent/Mattermost Agent escape outputCVE-2026-93546.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent Skills Guard Multi-Word Prompt skills_guard.py injectionCVE-2026-9353Fix available6.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent Messaging Gateway local.py _make_run_env information disclosureCVE-2026-93526.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent read_file Tool file_tools.py _is_blocked_device path traversalCVE-2026-93516.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent Batch Runner approval.py check_all_command_guards authorizationCVE-2026-93506.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent file_tools.py _check_sensitive_path symlinkCVE-2026-73974.8 Medium
- nousresearch hermes-agentNousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversalCVE-2026-73966.9 Medium
- nousresearch hermes-agentNousResearch hermes-agent Webhooks Endpoint webhook.py missing authenticationCVE-2026-71136.3 Medium
- nousresearch hermes-agentNousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authenticationCVE-2026-71126.3 Medium