PT-2026-42927 · Nousresearch · Hermes-Agent

Eric-I · Published 2026-05-24 · Updated 2026-05-24 · CVE-2026-9367

Mitre

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect dangerous command of the file tools/approval.py of the component terminal tool. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-9367

Affected Products

Hermes-Agent

References · 4

• 🔥 https://gist.github.com/YLChen-007/75fb10319693e86106ced2ef3a472c80 · Exploit
• https://vuldb.com/vuln/365330/cti · Note
• https://vuldb.com/vuln/365330 · Note
• https://vuldb.com/submit/812228 · Note