Executive brief
NousResearch hermes-agent is an AI agent framework that can execute commands and interact with messaging platforms like Feishu and WeCom. A security flaw allows these AI agents to accidentally leak sensitive messaging service credentials when running system commands. An attacker interacting with the agent could use this to steal corporate communication tokens, potentially allowing them to impersonate the company or access private messages.
Technical details
An information disclosure vulnerability exists in the `_make_run_env` function within `tools/environments/local.py` of the NousResearch hermes-agent. The issue stems from an incomplete environment variable blocklist in `_build_provider_env_blocklist()`, which fails to include keys defined in `_EXTRA_ENV_KEYS`. Consequently, when the agent executes subprocesses via the `terminal` or `execute_code` tools, sensitive credentials for messaging platforms (such as FEISHU_APP_SECRET, WECOM_SECRET, and MATRIX_PASSWORD) are inherited by the subprocess environment. A remote attacker can exploit this by inducing the agent to run commands like `printenv` via prompt injection, exfiltrating the secrets. As of the advisory date, the vendor has not responded to the disclosure.
Affected products
- NousResearch hermes-agent <= 2026.4.23
Timeline
- 2026-04-24: disclosed: Initial disclosure via GitHub Gist by researcher YLChen-007
- 2026-05-24: advisory: NVD/VulDB publication of CVE-2026-9352