PT-2026-35969 · Nousresearch · Hermes-Agent

Yu_Bao · Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-7397

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent version 0.8.0

Description A flaw in the check sensitive path() function within the tools/file tools.py file allows for symlink following, which occurs when a program follows a symbolic link to access a file or directory it should not. This issue requires local access for exploitation.

Recommendations Update to version 0.9.0.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

CWE-61

Related Identifiers

CVE-2026-7397

Affected Products

Hermes-Agent

References · 11

• 🔥 https://github.com/NousResearch/hermes-agent/issues/8734 · Exploit
• https://github.com/NousResearch/hermes-agent/commit/311dac197145e19e07df68feba2cd55d896a3cd1 · Patch
• https://github.com/NousResearch/hermes-agent/pull/8829 · Patch
• https://github.com/NousResearch/hermes-agent/releases/tag/v2026.4.13 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7397 · Security Note
• https://vuldb.com/submit/803270 · Note
• https://vuldb.com/vuln/360121/cti · Note
• https://github.com/NousResearch/hermes-agent · Note
• https://vuldb.com/vuln/360121 · Note
• https://twitter.com/VulmonFeeds/status/2049593342501998951 · Twitter Post
• https://twitter.com/CVEnew/status/2049578378358149631 · Twitter Post