Vulnerability · Published Jul 5, 2026 · Assigned by VulDB

CVE-2026-14783NousResearch hermes-agent skills_tool.py skill_view path traversal

Medium 4.3

In plain English

A medium-severity path traversal in hermes-agent from NousResearch. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 58.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in NousResearch hermes-agent 2026.5.29.2. The impacted element is the function skill_view of the file tools/skills_tool.py. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 56f833efa427ccb444c0f9ad1759af1012f2124d. It is advisable to implement a patch to correct this issue.

Affected products (as reported)

Vendor	Product	Versions
NousResearch	hermes-agent	2026.5.29.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

References

VDB-376373 | NousResearch hermes-agent skills_tool.py skill_view path traversal vdb-entry, technical-description
VDB-376373 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-14783 | CVE Analysis and Report third-party-advisory
Submit #847502 | NousResearch hermes-agent 2026.5.29.2 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) (CWE-22) third-party-advisory
https://github.com/NousResearch/hermes-agent/issues/38643 exploit, issue-tracking
https://github.com/NousResearch/hermes-agent/pull/40566 issue-tracking, patch
https://github.com/NousResearch/hermes-agent/commit/56f833efa427ccb444c0f9ad1759af1012f2124d patch
https://github.com/NousResearch/hermes-agent/ product