Executive brief
hermes-agent is an Electron-based desktop application used by NousResearch. A flaw in the resourceBufferFromUrl function allows remote attackers to trigger excessive resource allocation, potentially causing denial of service or performance degradation on affected systems.
Technical details
A resource exhaustion vulnerability exists in the resourceBufferFromUrl function within the Electron main process (apps/desktop/electron/main.ts) of hermes-agent. The vulnerability permits remote allocation of resources without proper bounds checking. The affected entry point (copyImageFromUrl) was present in v2026.8.3 but was removed by v2026.8.19 in favor of the native Electron event.sender.copyImageAt() implementation. Attack vectors and preconditions for exploitation of remaining vulnerable code paths are not fully detailed in available sources.
Affected products
- NousResearch hermes-agent 0.18.0
Timeline
- 2026-09-03: disclosed
- 2026-09-03: advisory