Unknown · Hermes-Agent · CVE-2026-9368
**Name of the Vulnerable Software and Affected Versions**
hermes-agent versions prior to 2026.4.17
**Description**
A remote attack can be launched against the Environment Variable Handler component. The issue resides in the `execute code()` function within the `tools/code execution tool.py` file, where manipulation can lead to a sandbox issue, potentially allowing code to escape the restricted execution environment.
**Recommendations**
Update to a version later than 2026.4.16.
As a temporary workaround, restrict access to the `execute code()` function in the `tools/code execution tool.py` file.