Server-Side Request Forgery in NousResearch Hermes-Agent 0.18.0
CVE-2026-85106

5.3MEDIUM

Key Information:

Vendor

Nousresearch

Status
Hermes-agent
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85106?

A vulnerability exists in NousResearch hermes-agent version 0.18.0 within the fetchLinkTitle function found in apps/desktop/src/app/artifacts/index.tsx. This flaw enables an attacker to manipulate the url argument, potentially leading to server-side request forgery (SSRF). The vulnerability can be exploited remotely, allowing unauthorized access to internal services or data. Despite early notifications to the vendor regarding this issue, there has been no response, highlighting an urgent need for users to secure their systems against potential exploitation.

Affected Version(s)

hermes-agent 0.18.0

References

https://vuldb.com/vuln/398313
vdb-entrytechnical-description
https://vuldb.com/vuln/398313/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-85106
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

KendrickZou (VulDB User)
VulDB CNA Team
.