hermes-agent Browser Private Network Policy Bypass via Eval Leading to Info Disclosure

Vulnerability Overview Title: Hermes Browser Private Network Policy Bypass via Eval-Triggered Main Frame Navigation Description: The Hermes browser tool blocks direct navigation to private or internal URLs in cloud browser mode; however, this policy is not enforced when the page context JavaScript changes the main frame's location. An attacker can invoke standard browser tools to open a public page, use to set to a loopback or internal target, and then read private page content returned via . This constitutes an information disclosure issue and a browser-side SSRF policy bypass. Scope Ecosystem: pip Package Name: hermes-agent Affected Versions: <= 0.16.0 Fixed Version: Not specified Remediation Fix Status: No specific fix provided, but upgrading to a patched version is recommended. POC Code Additional Key Information Vulnerability Logic: The vulnerability logic resides in . Hermes correctly applies private network validation during explicit navigation, but a flaw exists where accepts an expression argument and immediately routes to . Attack Flow: 1. Invoke to establish an active browser context on a public page. 2. Invoke . 3. The browser loads the private loopback page. 4. Invoke . 5. Hermes returns the private page content, even though the same target would be rejected if sent via . Impact: This issue allows tool-based attackers to bypass Hermes's private network browser restrictions and read data from loopback or internal network endpoints that should not be accessible via protected browser paths. In real-world deployments, this could expose localhost-only dashboards, internal web applications, development services, or other browser-accessible content. Severity: Medium Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Weakness: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Occurrence Permalink: - browser_navigate() - browser_navigate() - browser_console() - _browser_eval() - browser_snapshot() Log Evidence Experimental Log Excerpt: Control Log Excerpt: Summary This vulnerability allows attackers to bypass Hermes's private network policy via eval-triggered navigation, resulting in information disclosure and SSRF issues. It is recommended to upgrade to a patched version to resolve this problem.

Goal Reached Thanks to every supporter — we hit 100%!

hermes-agent Browser Private Network Policy Bypass via Eval Leading to Info Disclosure

More from this source