# CVE-2026-14783: NousResearch hermes-agent path traversal in skill_view

Source: https://junglewise.ai/threats/cve-2026-14783-nousresearch-hermes-agent-path-traversal-in-skill-view  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-14783 · Severity: medium · CVSS 4.3 · Published 2026-07-06

NousResearch hermes-agent is an AI agent framework. A security vulnerability in its skill-viewing tool allows an attacker to bypass directory restrictions and access files they should not be able to see. This could lead to the exposure of sensitive information, such as API keys, configuration files, or environment secrets stored on the host system.

Technologies: [NousResearch Hermes Agent](https://junglewise.ai/threats/technologies/hermes-agent). Vendors: [NousResearch](https://junglewise.ai/threats/vendors/nousresearch).

## Quick answers

**Is CVE-2026-14783 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14783 being exploited in the wild.

**How severe is CVE-2026-14783?** Medium severity, with a CVSS score of 4.3, published 6 July 2026.

**Which products and versions are affected?** NousResearch Hermes Agent 2026.5.29.2.

**Is there a fix for CVE-2026-14783?** A patch was published on 2026-06-06: Fix merged in pull request 40566 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14783 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14783?** Check whether you run NousResearch Hermes Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in NousResearch hermes-agent version 2026.5.29.2 within the `skill_view` function of `tools/skills_tool.py`. The root cause is the improper validation of the `Name` argument, which is joined with the trusted search root using `search_dir / name` before any containment checks are performed. An attacker can provide a manipulated path (e.g., `../outside-skill`) to select a directory outside the intended `~/.hermes/skills/` boundary. If the target directory contains a `SKILL.md` file, the agent will treat it as a valid skill directory, allowing subsequent file reads (via `file_path`) to leak sensitive files like `.env` from the host. The issue has been addressed in commit 56f833efa427ccb444c0f9ad1759af1012f2124d.

## Affected products

- NousResearch hermes-agent 2026.5.29.2

## Timeline

- 2026-06-06: patched: Fix merged in pull request 40566
- 2026-07-06: advisory: NVD publication date

## References

- [https://github.com/NousResearch/hermes-agent/](https://github.com/NousResearch/hermes-agent/)
- [https://github.com/NousResearch/hermes-agent/commit/56f833efa427ccb444c0f9ad1759af1012f2124d](https://github.com/NousResearch/hermes-agent/commit/56f833efa427ccb444c0f9ad1759af1012f2124d)
- [https://github.com/NousResearch/hermes-agent/issues/38643](https://github.com/NousResearch/hermes-agent/issues/38643)
- [https://github.com/NousResearch/hermes-agent/pull/40566](https://github.com/NousResearch/hermes-agent/pull/40566)
- [https://vuldb.com/cve/CVE-2026-14783](https://vuldb.com/cve/CVE-2026-14783)
- [https://vuldb.com/submit/847502](https://vuldb.com/submit/847502)
- [https://vuldb.com/vuln/376373](https://vuldb.com/vuln/376373)

## Related threats

- [NousResearch hermes-agent resource exhaustion in resourceBufferFromUrl](https://junglewise.ai/threats/cve-2026-85107-nousresearch-hermes-agent-resource-exhaustion-in)
- [NousResearch hermes-agent server-side request forgery in Link Title Fetch](https://junglewise.ai/threats/cve-2026-85106-nousresearch-hermes-agent-server-side-request-forgery-in-link)
- [NousResearch hermes-agent authorization bypass in Session Management](https://junglewise.ai/threats/cve-2026-85105-nousresearch-hermes-agent-authorization-bypass-in-session)
- [NousResearch hermes-agent denial of service in MCP Tool](https://junglewise.ai/threats/cve-2026-84289-nousresearch-hermes-agent-denial-of-service-in-mcp-tool)
- [NousResearch hermes-agent denial of service in ACP Prompt Workflow](https://junglewise.ai/threats/cve-2026-84288-nousresearch-hermes-agent-denial-of-service-in-acp-prompt)