CVE-2026-7397 in hermes-agent
Summary
by MITRE • 04/29/2026
A security flaw has been discovered in NousResearch hermes-agent 0.8.0. This affects the function _check_sensitive_path of the file tools/file_tools.py. The manipulation results in symlink following. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.9.0 is able to mitigate this issue. The patch is identified as 311dac197145e19e07df68feba2cd55d896a3cd1. Upgrading the affected component is recommended.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/15/2026
The security vulnerability identified in NousResearch hermes-agent version 0.8.0 represents a critical path traversal issue within the _check_sensitive_path function located in tools/file_tools.py. This flaw enables attackers to exploit symbolic link following mechanisms through local manipulation, creating potential unauthorized access to sensitive system resources. The vulnerability specifically targets the file handling capabilities of the application, where improper validation of file paths allows malicious actors to traverse directories beyond the intended scope. The issue is particularly concerning as it requires local access for exploitation, meaning attackers must already have system-level privileges or physical access to the target machine. However, once achieved, this vulnerability can be leveraged to bypass security controls and potentially access restricted files or directories that should remain protected from unauthorized access.
The technical implementation of this vulnerability stems from inadequate input validation and path resolution handling within the file_tools module. When the _check_sensitive_path function processes file paths, it fails to properly sanitize or validate symbolic links, allowing attackers to craft malicious input that exploits the symlink following behavior. This type of vulnerability falls under the CWE-357 weakness category, specifically related to insufficient protection against symlink following, which is a well-documented security issue in file system operations. The vulnerability creates a condition where the application's file access controls can be circumvented through careful manipulation of symbolic links, potentially exposing sensitive data or system resources to unauthorized access. The attack vector is limited to local execution but remains highly impactful due to the privilege escalation potential it provides.
The operational impact of this vulnerability extends beyond simple file access issues, as it can enable attackers to bypass security boundaries within the application's file handling mechanisms. Local attackers with access to the system can exploit this weakness to gain access to sensitive files, potentially including configuration data, user credentials, or other confidential information stored in the application's directory structure. The vulnerability's public exploit availability significantly increases the risk profile, as it eliminates the need for sophisticated attack development and allows any attacker with local access to potentially leverage this flaw. This represents a serious concern for organizations relying on the hermes-agent for sensitive operations, as it could lead to data breaches or unauthorized system access. The vulnerability demonstrates a fundamental flaw in the application's security architecture, particularly in how it handles file system operations and path validation.
The recommended mitigation strategy involves upgrading to version 0.9.0, which contains the necessary patch to address this vulnerability. The specific patch identified as 311dac197145e19e07df68feba2cd55d896a3cd1 implements proper validation of symbolic links and ensures that the _check_sensitive_path function correctly handles path resolution without allowing unintended traversal. This update addresses the root cause by modifying the file handling logic to properly validate and sanitize all input paths before processing. Organizations should prioritize this upgrade as a critical security measure, particularly in environments where the hermes-agent is deployed with elevated privileges or access to sensitive data. The patch aligns with industry best practices for preventing symlink following attacks and demonstrates proper application of the principle of least privilege in file system operations. Security teams should also consider implementing additional monitoring for suspicious file access patterns and ensure that proper access controls are maintained throughout the system to minimize the potential impact of any remaining vulnerabilities.