CVE-2026-9367

5.5 mediumEPSS 2.7%

Medium (5.5). EPSS 2.7% chance of exploitation in the next 30 days.

A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect_dangerous_command of the file tools/approval.py of the component terminal_tool. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.3 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS: 2.7% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-78
Published: 2026-05-24
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

References

https://gist.github.com/YLChen-007/75fb10319693e86106ced2ef3a472c80
https://vuldb.com/submit/812228
https://vuldb.com/vuln/365330
https://vuldb.com/vuln/365330/cti

Check your stack JSON