Executive brief
Hermes-agent is a browser automation tool used to control headless browsers for data extraction and web tasks. An attacker who can invoke browser commands can bypass private network protections by using JavaScript execution to navigate to internal URLs (like localhost services), then capturing the page content. This allows an attacker to read sensitive data from internal or private services that should be off-limits.
Technical details
The vulnerability is a server-side request forgery (SSRF) policy bypass in the browser tooling component (tools/browser_tool.py). The root cause is a control-flow gap: while the browser_navigate() function correctly validates URLs against a private-network blocklist, the browser_console() function executes attacker-controlled JavaScript without re-validating the resulting page URL. An attacker can chain browser_navigate(public_url) → browser_console(expression="location.href='http://127.0.0.1:port'") → browser_snapshot() to access private pages. The attack requires the ability to call Hermes browser tools, which is the expected usage model. No patch status is documented; the vendor was contacted early but did not respond.
Affected products
- NousResearch hermes-agent up to 0.16.0
Timeline
- 2026-06-12: disclosed: Vulnerability disclosed publicly via GitHub Gist
- 2026-08-04: other: CVE-2026-18775 published