Vulnerability · Published Jul 4, 2026 · Assigned by VulDB
CVE-2026-14628NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal
Medium 5.3
In plain English
A medium-severity path traversal in hermes-agent from NousResearch. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability was detected in NousResearch hermes-agent up to 2026.5.16. This impacts the function extract_media of the file gateway/platforms/base.py of the component Live Webhook Endpoint. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NousResearch | hermes-agent | 2026.5.02026.5.12026.5.22026.5.32026.5.42026.5.52026.5.62026.5.7 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
References
- VDB-376144 | NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal vdb-entry, technical-description
- VDB-376144 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-14628 | CVE Analysis and Report third-party-advisory
- Submit #845599 | NousResearch Hermes Agent <= v2026.5.16 Path Traversal / Improper Limitation of a Pathname to a Restricted Directory (CWE-22) third-party-advisory
- https://gist.github.com/YLChen-007/8af7eff27b50bec24b2d0f76dd1c4383 exploit