Executive brief
NousResearch hermes-agent, a tool for managing AI agents, contains a security flaw that allows for the execution of unauthorized commands. The software's security scanner, designed to block dangerous activities, is bypassed when certain commands are sent through its gateway or management interface. This could allow an attacker to take control of the host system, access sensitive data, or disrupt operations.
Technical details
A protection mechanism failure (CWE-693) exists in the hermes-agent gateway layer, specifically within the shell.exec JSON-RPC method and the command.dispatch function for Quick Commands. While the core LLM execution loop uses the Tirith scanner via check_all_command_guards(), these gateway paths invoke native subshells (subprocess.run and asyncio.create_subprocess_shell) directly. An attacker with access to the TUI JSON-RPC interface or the ability to trigger configured quick commands can bypass security filters to achieve Remote Code Execution (RCE). The vulnerability affects versions up to 0.15.2 and remains unpatched as the vendor did not respond to disclosure.
Affected products
- NousResearch hermes-agent up to 0.15.2
Timeline
- 2026-06-01: disclosed: Initial discovery and Gist publication by researcher YLChen-007
- 2026-07-04: advisory: CVE-2026-14625 published via NVD/VulDB