PT-2026-35964 · Nousresearch · Hermes-Agent

Yu_Bao · Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-7396

NVD

CVSS v2.0

5.0

Medium

AV:N/AC:L/Au:N/C:P/I:N/A:N

A vulnerability was identified in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/wecom.py of the component WeChat Work Platform Adapter. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7396

Affected Products

Hermes-Agent

References · 7

• 🔥 https://github.com/NousResearch/hermes-agent/issues/8733 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7396 · Security Note
• https://vuldb.com/submit/803269 · Note
• https://github.com/NousResearch/hermes-agent · Note
• https://vuldb.com/vuln/360120/cti · Note
• https://vuldb.com/vuln/360120 · Note
• https://github.com/bugmaker2/hermes-agent/issues/29 · Note