hermes-agent vulnerabilities

CVEs whose affected-version data names the hermes-agent package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

10 CVEsRSS

CVE-2026-53870Medium· 5.5PoC

4mo ago

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can r…

▾ TwilightNousResearch · hermes-agentEPSS 0.16%via NVD

CVE-2026-53869High· 7.5

4mo ago

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/p…

▾ TwilightNousResearch · hermes-agentEPSS 0.59%via NVD

CVE-2026-10224Medium· 5.3

4mo ago

hermes-agent vulnerabilities

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation

hermes-agent has an Uncontrolled Resource Consumption issue

hermes-agent has an Injection issue

hermes-agent has an Injection issue

hermes-agent has an Injection issue

hermes-agent has a sandbox issue

hermes-agent has an Injection issue

hermes-agent has an Incorrect Comparison

hermes-agent has an Injection issue