PT-2026-59174 · Pypi · Hermes-Agent

Publicado 2026-07-13 · Atualizado 2026-07-13

OSV

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Hermes Agent before 0.16.0 creates response store.db and webhook subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including conversation history, tool payloads, prompts, and per-route HMAC secrets.

Correção

Identificadores relacionados

PYSEC-2026-2511

Produtos afetados

Hermes-Agent

Referências · 10

• https://github.com/NousResearch/hermes-agent · Nota
• https://github.com/NousResearch/hermes-agent/pull/31469 · Nota
• https://github.com/NousResearch/hermes-agent/commit/3bace071bfadf2d2bec2ee048471a31ec920e3e8 · Nota
• https://github.com/NousResearch/hermes-agent/pull/30917 · Nota
• https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5 · Nota
• https://vulncheck.com/advisories/hermes-agent-sensitive-file-permission-vulnerability-in-store-files · Nota
• https://github.com/advisories/GHSA-99f9-j8r3-p853 · Nota
• https://pypi.org/project/hermes-agent · Nota
• https://osv.dev/vulnerability/PYSEC-2026-2511 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-53870 · Nota de Segurança