Quick answers
- Is CVE-2026-9367 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9367 being exploited in the wild.
- How severe is CVE-2026-9367?
- High severity, with a CVSS score of 7.3, published 24 May 2026.
- Which products and versions are affected?
- NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63.
- Is there a fix for CVE-2026-9367?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-9367 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-9367?
- Check whether you run NousResearch Hermes Agent. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An OS command injection vulnerability exists in the `detect_dangerous_command` function within `tools/approval.py` of the NousResearch hermes-agent. The component uses a blacklist-based approach with regular expressions to identify and block dangerous shell commands (e.g., piping curl to bash). However, the regex patterns are insufficient and can be bypassed using semantically equivalent bash syntax, such as command substitution (e.g., `eval $(curl ...)`). A remote attacker can exploit this by providing a crafted prompt to the LLM agent, causing it to execute arbitrary shell commands without triggering the required human approval prompt. As of the advisory date, the vendor has not responded to the disclosure.
Affected products
- NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63
Timeline
- 2026-04-24: disclosed: Public disclosure of the bypass and proof-of-concept via GitHub Gist.
- 2026-05-24: advisory: NVD/VulDB advisory published.