# CVE-2026-18775: NousResearch hermes-agent SSRF in browser tooling

Source: https://junglewise.ai/threats/cve-2026-18775-nousresearch-hermes-agent-ssrf-in-browser-tooling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18775 · Severity: medium · CVSS 6.3 · Published 2026-08-04

Hermes-agent is a browser automation tool used to control headless browsers for data extraction and web tasks. An attacker who can invoke browser commands can bypass private network protections by using JavaScript execution to navigate to internal URLs (like localhost services), then capturing the page content. This allows an attacker to read sensitive data from internal or private services that should be off-limits.

Technologies: [NousResearch Hermes Agent](https://junglewise.ai/threats/technologies/hermes-agent). Vendors: [NousResearch](https://junglewise.ai/threats/vendors/nousresearch).

## Quick answers

**Is CVE-2026-18775 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18775 being exploited in the wild.

**How severe is CVE-2026-18775?** Medium severity, with a CVSS score of 6.3, published 4 August 2026.

**Which products and versions are affected?** NousResearch Hermes Agent up to 0.16.0.

**Is there a fix for CVE-2026-18775?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18775 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-18775?** Check whether you run NousResearch Hermes Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) policy bypass in the browser tooling component (tools/browser_tool.py). The root cause is a control-flow gap: while the browser_navigate() function correctly validates URLs against a private-network blocklist, the browser_console() function executes attacker-controlled JavaScript without re-validating the resulting page URL. An attacker can chain browser_navigate(public_url) → browser_console(expression="location.href='http://127.0.0.1:port'") → browser_snapshot() to access private pages. The attack requires the ability to call Hermes browser tools, which is the expected usage model. No patch status is documented; the vendor was contacted early but did not respond.

## Affected products

- NousResearch hermes-agent up to 0.16.0

## Timeline

- 2026-06-12: disclosed: Vulnerability disclosed publicly via GitHub Gist
- 2026-08-04: other: CVE-2026-18775 published

## References

- [https://gist.github.com/YLChen-007/2e5bf7fa58113967807425032234cc89](https://gist.github.com/YLChen-007/2e5bf7fa58113967807425032234cc89)
- [https://vuldb.com/cve/CVE-2026-18775](https://vuldb.com/cve/CVE-2026-18775)

## Related threats

- [NousResearch hermes-agent resource exhaustion in resourceBufferFromUrl](https://junglewise.ai/threats/cve-2026-85107-nousresearch-hermes-agent-resource-exhaustion-in)
- [NousResearch hermes-agent server-side request forgery in Link Title Fetch](https://junglewise.ai/threats/cve-2026-85106-nousresearch-hermes-agent-server-side-request-forgery-in-link)
- [NousResearch hermes-agent authorization bypass in Session Management](https://junglewise.ai/threats/cve-2026-85105-nousresearch-hermes-agent-authorization-bypass-in-session)
- [NousResearch hermes-agent denial of service in MCP Tool](https://junglewise.ai/threats/cve-2026-84289-nousresearch-hermes-agent-denial-of-service-in-mcp-tool)
- [NousResearch hermes-agent denial of service in ACP Prompt Workflow](https://junglewise.ai/threats/cve-2026-84288-nousresearch-hermes-agent-denial-of-service-in-acp-prompt)