CVE-2026-18774 in hermes-agent
Summary
by MITRE • 08/04/2026
A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability identified in NousResearch hermes-agent version 0.16.0 represents a critical server-side request forgery flaw within the xAI Image Generation Provider component. This security weakness resides in the save_url_image function located in agent/image_gen_provider.py, where improper input validation and handling creates an avenue for malicious actors to manipulate the application's behavior. The vulnerability stems from insufficient sanitization of URL parameters that are processed by the image generation functionality, allowing attackers to specify arbitrary URLs that the system will attempt to access and process as images.
The technical implementation of this flaw enables remote exploitation through crafted URL inputs that bypass normal validation mechanisms. When the save_url_image function processes external URLs, it fails to properly validate or sanitize the input parameters, creating an environment where attacker-controlled data can be executed within the context of the application's image processing workflow. This vulnerability falls under the CWE-918 category of Server-Side Request Forgery, which specifically addresses the issue of applications making unintended requests to internal or external resources based on user-supplied input. The attack vector is particularly dangerous because it allows remote code execution capabilities through the image generation provider's request handling mechanism.
The operational impact of this vulnerability extends beyond simple data theft or service disruption, as it enables attackers to potentially access internal network resources that would normally be protected by firewalls and network segmentation. An attacker could leverage this flaw to probe internal systems, exfiltrate sensitive data from behind network boundaries, or even establish persistent access through the image generation service. The fact that a working exploit has been published demonstrates the maturity of the attack methodology and increases the likelihood of exploitation across vulnerable deployments. This vulnerability particularly affects organizations that rely on the hermes-agent for automated image processing workflows where external inputs are accepted without proper validation.
Security mitigation strategies should prioritize immediate patching of the affected component to version 0.16.1 or later, which contains the necessary fixes for input validation and URL sanitization. Organizations should implement network-level restrictions that prevent outbound connections from the image generation service to internal resources, effectively limiting the potential impact of successful exploitation attempts. Additionally, implementing proper input validation mechanisms that sanitize all external URL parameters before processing, combined with network segmentation controls, can significantly reduce the risk exposure. The ATT&CK framework categorizes this vulnerability under T1190 - Proxying and T1071.004 - Application Layer Protocol: DNS, as attackers may use this flaw to establish command and control channels or perform reconnaissance activities through the compromised image generation service. Organizations should also consider implementing monitoring and logging controls specifically for image processing workflows to detect anomalous behavior patterns that might indicate exploitation attempts.