Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

hermes-agent — Vulnerabilities & Security Advisories 44

All 44 CVE vulnerabilities found in hermes-agent, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with the hermes-agent software, focusing on specific weakness types and relevant security tags. It compiles data on known flaws such as remote code execution, privilege escalation, and information disclosure, covering reports from recent years through current advisories. Readers can use this resource to track vendor-issued advisories, analyze the prevalence of particular weakness classes within the application, or review the comprehensive vulnerability history of the hermes-agent product to assess its overall security posture and evolution over time.

Vendor: NousResearch

CVE ID Title CVSS Severity Published
CVE-2026-71963 Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection CWE-78 8.8 High 2026-09-03
CVE-2026-85107 NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources CWE-770 4.3 Medium 2026-09-03
CVE-2026-85106 NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery CWE-918 6.3 Medium 2026-09-03
CVE-2026-85105 NousResearch hermes-agent Session Management s71.py _sess_nowait authorization CWE-639 7.3 High 2026-09-03
CVE-2026-84289 NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation CWE-789 4.3 Medium 2026-09-01
CVE-2026-84288 NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service CWE-404 4.3 Medium 2026-09-01
CVE-2026-84287 NousResearch hermes-agent Session Chat api_server.py denial of service CWE-404 4.3 Medium 2026-09-01
CVE-2026-82021 Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference CWE-494 8.3 High 2026-08-28
CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool CWE-552 6.8 Medium 2026-08-28
CVE-2026-18993 NousResearch hermes-agent Memory Toolset model_tools.py access control CWE-284 6.3 Medium 2026-08-06
CVE-2026-18976 NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment CWE-266 6.3 Medium 2026-08-06
CVE-2026-18775 NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery CWE-918 6.3 Medium 2026-08-04
CVE-2026-18774 NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery CWE-918 6.3 Medium 2026-08-04
CVE-2026-18773 NousResearch hermes-agent Quick run.py _check_slash_access authorization CWE-863 6.3 Medium 2026-08-04
CVE-2026-17432 NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control CWE-284 5.0 Medium 2026-07-26
CVE-2026-15311 NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting CWE-79 3.5 Low 2026-07-09
CVE-2026-14783 NousResearch hermes-agent skills_tool.py skill_view path traversal CWE-22 4.3 Medium 2026-07-05
CVE-2026-14628 NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal CWE-22 5.3 Medium 2026-07-04
CVE-2026-14627 NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication CWE-287 5.6 Medium 2026-07-04
CVE-2026-14626 NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service CWE-404 4.3 Medium 2026-07-04
CVE-2026-14625 NousResearch hermes-agent server.py shell.exec protection mechanism CWE-693 6.3 Medium 2026-07-04
CVE-2026-14617 NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity CWE-178 3.1 Low 2026-07-03
CVE-2026-53870 Hermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store Files CWE-276 5.5 Medium 2026-06-17
CVE-2026-53869 Hermes Agent < 0.16.0 - DNS Rebinding Bypass via WebSocket Endpoints CWE-306 7.5 High 2026-06-17
CVE-2026-11461 NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization CWE-639 6.3 Medium 2026-06-07
CVE-2026-10548 NousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authentication CWE-287 5.3 Medium 2026-06-02
CVE-2026-10224 NousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumption CWE-400 5.3 Medium 2026-06-01
CVE-2026-10223 NousResearch hermes-agent memory_tool.py _scan_memory_content injection CWE-74 6.3 Medium 2026-06-01
CVE-2026-10222 NousResearch hermes-agent config.py _sanitize_env_lines injection CWE-74 5.6 Medium 2026-06-01
CVE-2026-10221 NousResearch hermes-agent run_agent.py _compress_context injection CWE-74 7.3 High 2026-06-01

All 44 known CVE vulnerabilities affecting hermes-agent with full Chinese analysis, references, and POCs where available.