NousResearch vulnerabilities
We track 11 vulnerabilities in NousResearch products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on September 3, 2026.
Latest NousResearch vulnerabilities
- 8.8 High severity
hermes-agent: Improper Neutralization of Special Elements used in an OS Command
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an att
- 7.3 High severity
hermes-agent: Improper Authorization
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Management. This manipulation of the argument session_id causes authorization bypass. The attack can be i
- 8.3 High severity
hermes-agent: Download of Code Without Integrity Check
Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned
- 7.5 High severity
hermes-agent: Missing Authentication for Critical Functionality
Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub,
- 7.3 High severity
hermes-agent: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in NousResearch hermes-agent up to 0.12.0. Affected by this vulnerability is the function _compress_context of the file run_agent.py. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploi
- 7.3 High severity
hermes-agent: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function _serve_plugin_skill/skill_view of the file tools/skills_tool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The
- 7.3 High severity
A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16.
A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Environment Variable Handler. Such manipulation leads to sandbox issue. It is possible
- 7.3 High severity
hermes-agent: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect_dangerous_command of the file tools/approval.py of the component terminal_tool. This manipulation causes os command inj
- 7.3 High severity
hermes-agent: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function _scan_context_content of the file agent/prompt_builder.py. The manipulation results in injection. The attack may be performed from remote. The exploit has be
- 7.3 High severity
hermes-agent: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.23. Impacted is an unknown function of the file agent/skills_guard.py of the component Skills Guard Multi-Word Prompt Handler. The manipulation of the argument THREAT_PATTERNS
- 7.3 High severity
hermes-agent: Missing Authorization
A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This affects the function check_all_command_guards of the file tools/approval.py of the component Batch Runner. Such manipulation leads to missing authorization. The attack can be lau