Advisories · Technology
NousResearch hermes-agent.
Every CVE that names NousResearch hermes-agent among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
- NousResearch hermes-agent
- Command injection
- CVSS 5.3 Medium
NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources
- NousResearch hermes-agent
- Denial of service
- CVSS 5.3 Medium
NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery
- NousResearch hermes-agent
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
NousResearch hermes-agent Session Management s71.py _sess_nowait authorization
- NousResearch hermes-agent
- Broken access control
- CVSS 5.3 Medium
NousResearch hermes-agent MCP Tool mcp_tool.py list_tools memory allocation
- NousResearch hermes-agent
- Denial of service
- CVSS 5.3 Medium
NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service
- NousResearch hermes-agent
- Denial of service
- CVSS 5.3 Medium
NousResearch hermes-agent Session Chat api_server.py denial of service
- NousResearch hermes-agent
- Denial of service
- CVSS 9.0 CriticalCritical · CVSS 9+
Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference
- NousResearch hermes-agent
- CWE-494
- CVSS 7.6 High
Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool
- NousResearch hermes-agent
- Information disclosure
- CVSS 5.3 Medium
NousResearch hermes-agent Memory Toolset model_tools.py access control
- NousResearch hermes-agent
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment
- NousResearch hermes-agent
- Privilege escalation
- CVSS 5.3 Medium
NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery
- NousResearch hermes-agent
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery
- NousResearch hermes-agent
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
NousResearch hermes-agent Quick run.py _check_slash_access authorization
- NousResearch hermes-agent
- Broken access control
- CVSS 2.3 Low
NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control
- NousResearch hermes-agent
- Privilege escalation
- Broken access control
- CVSS 5.1 Medium
NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter._markdown_to_html cross site scripting
- NousResearch hermes-agent
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
NousResearch hermes-agent skills_tool.py skill_view path traversal
- NousResearch hermes-agent
- Path traversal
- CVSS 6.9 Medium
NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal
- NousResearch hermes-agent
- Path traversal
- CVSS 6.3 Medium
NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication
- NousResearch hermes-agent
- Authentication bypass
- CVSS 5.3 Medium
NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service
- NousResearch hermes-agent
- Denial of service
- CVSS 5.3 Medium
NousResearch hermes-agent server.py shell.exec protection mechanism
- NousResearch hermes-agent
- CWE-693
- CVSS 2.3 Low
NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity
- NousResearch hermes-agent
- CWE-178
- CWE-697
- CVSS 5.3 Medium
NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization
- NousResearch hermes-agent
- Broken access control
- CVSS 4.8 Medium
NousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authentication
- NousResearch hermes-agent
- Authentication bypass
- CVSS 6.9 Medium
NousResearch hermes-agent skills_tool.py skill_view injection
- NousResearch hermes-agent
- Other injection
- CWE-707
- CVSS 6.9 Medium
NousResearch hermes-agent terminal_tool approval.py detect_dangerous_command os command injection
- NousResearch hermes-agent
- Command injection
- CVSS 6.9 Medium
NousResearch hermes-agent Slack Agent/Mattermost Agent escape output
- NousResearch hermes-agent
- Other injection
- CWE-116
- CVSS 6.9 Medium
NousResearch hermes-agent Messaging Gateway local.py _make_run_env information disclosure
- NousResearch hermes-agent
- Information disclosure
- Broken access control
- CVSS 6.9 Medium
NousResearch hermes-agent read_file Tool file_tools.py _is_blocked_device path traversal
- NousResearch hermes-agent
- Path traversal
- CVSS 6.9 Medium
NousResearch hermes-agent Batch Runner approval.py check_all_command_guards authorization
- NousResearch hermes-agent
- Broken access control
- CVSS 4.8 Medium
NousResearch hermes-agent file_tools.py _check_sensitive_path symlink
- NousResearch hermes-agent
- Path traversal
- CWE-61
- CVSS 6.9 Medium
NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal
- NousResearch hermes-agent
- Path traversal
- CVSS 6.3 Medium
NousResearch hermes-agent Webhooks Endpoint webhook.py missing authentication
- NousResearch hermes-agent
- Authentication bypass
- CVSS 6.3 Medium
NousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication
- NousResearch hermes-agent
- Authentication bypass