Executive brief
Hermes Agent is an AI agent framework that uses a catalog of third-party model context protocol (MCP) tools. Prior to version 0.19.0, the application referenced external code repositories using mutable branch names (like "main") instead of pinned commit hashes, allowing an attacker who compromises an upstream repository to inject malicious code that automatically propagates to all hosts installing that catalog entry without requiring user action.
Technical details
This is a supply chain vulnerability rooted in insufficient dependency pinning in the MCP catalog manifest. The vulnerable component is the bundled catalog entries that reference third-party MCP repositories via mutable Git branches rather than immutable commit SHAs. The attack vector is network-based: an attacker with commit access to an upstream repository can push malicious code to a branch (e.g., "main") referenced by the Hermes Agent catalog. When operators install or update the affected catalog entry, the application automatically fetches and executes the poisoned code without further validation. The fix (version 0.19.0 and later) enforces exact version pinning: Git-based installs must use full 40-character commit SHAs, and package-based installs must use explicit version specifiers (e.g., pkg==X.Y.Z) rather than ranges or tags.
Affected products
- Nous Research Hermes Agent 0.18.2 prior to 0.19.0
Timeline
- 2026-08-28: disclosed: CVE-2026-82021 published
- 2026-07-15: patched: Version 0.19.0 released with exact version pin enforcement (commit 9df5f87)