CVE-2026-14783

MEDIUM

NousResearch hermes-agent skills_tool.py skill_view path traversal

Title source: cna
STIX 2.1

Description

A vulnerability was determined in NousResearch hermes-agent 2026.5.29.2. The impacted element is the function skill_view of the file tools/skills_tool.py. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 56f833efa427ccb444c0f9ad1759af1012f2124d. It is advisable to implement a patch to correct this issue.

References (8)

Core 8
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-376373 | NousResearch hermes-agent skills_tool.py skill_view path traversal
https://vuldb.com/vuln/376373
Signature, Permissions Required signature permissions-required
VDB-376373 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/376373/cti
Third Party Advisory third-party-advisory
CVE-2026-14783 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-14783
Third Party Advisory third-party-advisory
Submit #847502 | NousResearch hermes-agent 2026.5.29.2 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) (CWE-22)
https://vuldb.com/submit/847502

Scores

CVSS v3 4.3
EPSS 0.0033
EPSS Percentile 25.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
NousResearch/hermes-agent 2026.5.29.2
Published Jul 06, 2026
Tracked Since Jul 06, 2026