CVE-2026-7396

5.5 mediumEPSS 0.5%

A vulnerability was identified in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/wecom.py of the component WeChat Work Platform Adapter. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2026-04-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/NousResearch/hermes-agent/
https://github.com/NousResearch/hermes-agent/issues/8733
https://github.com/bugmaker2/hermes-agent/issues/29
https://vuldb.com/submit/803269
https://vuldb.com/vuln/360120

Check your stack JSON