# CVE-2026-9351: NousResearch hermes-agent path traversal in read_file tool

Source: https://junglewise.ai/threats/cve-2026-9351-nousresearch-hermes-agent-path-traversal-in-read-file-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-24. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9351 · Severity: medium · CVSS 6.5 · Published 2026-05-24

NousResearch hermes-agent is a tool used to give AI agents the ability to interact with local files. A security flaw allows remote users to bypass safety checks and force the agent to read restricted system device files. This can cause the agent to hang indefinitely, leading to a denial of service that prevents other users from accessing the system.

Technologies: [NousResearch Hermes Agent](https://junglewise.ai/threats/technologies/hermes-agent). Vendors: [NousResearch](https://junglewise.ai/threats/vendors/nousresearch).

## Quick answers

**Is CVE-2026-9351 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9351 being exploited in the wild.

**How severe is CVE-2026-9351?** Medium severity, with a CVSS score of 6.5, published 24 May 2026.

**Which products and versions are affected?** NousResearch Hermes Agent <= 2026.4.16.

**Is there a fix for CVE-2026-9351?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9351 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9351?** Check whether you run NousResearch Hermes Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the `_is_blocked_device` function within `tools/file_tools.py` of NousResearch hermes-agent. The function attempts to block access to dangerous device files (like /dev/zero) using `os.path.expanduser()` for normalization, which fails to resolve standard UNIX path sequences like './' or '../'. An attacker can bypass the blocklist by providing a path such as '/dev/./zero', causing the agent to enter an infinite read loop when the OS resolves the path. This results in a process hang or thread exhaustion, particularly impactful in gateway deployments (e.g., Discord or Telegram bots). As of the advisory date, the vendor has not responded to the disclosure.

## Affected products

- NousResearch hermes-agent <= 2026.4.16

## Timeline

- 2026-04-24: disclosed: Initial discovery and public Gist disclosure
- 2026-05-24: advisory: CVE published to NVD

## References

- [https://gist.github.com/YLChen-007/1d1aeff404cb88e06ec2fb3377f49fef](https://gist.github.com/YLChen-007/1d1aeff404cb88e06ec2fb3377f49fef)
- [https://vuldb.com/submit/812214](https://vuldb.com/submit/812214)
- [https://vuldb.com/vuln/365314](https://vuldb.com/vuln/365314)
- [https://vuldb.com/vuln/365314/cti](https://vuldb.com/vuln/365314/cti)

## Related threats

- [NousResearch hermes-agent resource exhaustion in resourceBufferFromUrl](https://junglewise.ai/threats/cve-2026-85107-nousresearch-hermes-agent-resource-exhaustion-in)
- [NousResearch hermes-agent server-side request forgery in Link Title Fetch](https://junglewise.ai/threats/cve-2026-85106-nousresearch-hermes-agent-server-side-request-forgery-in-link)
- [NousResearch hermes-agent authorization bypass in Session Management](https://junglewise.ai/threats/cve-2026-85105-nousresearch-hermes-agent-authorization-bypass-in-session)
- [NousResearch hermes-agent denial of service in MCP Tool](https://junglewise.ai/threats/cve-2026-84289-nousresearch-hermes-agent-denial-of-service-in-mcp-tool)
- [NousResearch hermes-agent denial of service in ACP Prompt Workflow](https://junglewise.ai/threats/cve-2026-84288-nousresearch-hermes-agent-denial-of-service-in-acp-prompt)