CVE-2026-14625: NousResearch Hermes-Agent Shell Execution Vulnerability

Technical summary

CVE-2026-14625 stems from a protection mechanism failure in the shell.exec function within tui_gateway/server.py of hermes-agent. The vulnerability is classified under CWE-693 (Protection Mechanism Failure) and allows an authenticated remote attacker to circumvent intended security restrictions. The CVSS 3.1 score of 6.3 (Medium severity, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects that while remote network access is required and the attacker must be authenticated, the impact spans confidentiality, integrity, and availability. The low attack complexity indicates that exploitation does not require special conditions or extensive effort.

Business impact

For organizations deploying hermes-agent in production—particularly those using it for automated AI workflows or multi-tenant environments—this vulnerability enables authenticated users to execute arbitrary system commands. This could lead to data exfiltration, lateral movement within infrastructure, service disruption, or establishment of persistence. The public availability of exploit code significantly accelerates the risk timeline, as malicious insiders or compromised accounts can quickly weaponize the flaw. Organizations should prioritize assessment of whether hermes-agent is internet-facing, how tightly access is controlled, and what system-level privileges the service runs under.

Affected systems

NousResearch hermes-agent versions through 0.15.2 are affected. Deployment scope is typically among researchers, AI developers, and organizations building agent-based automation systems. The vulnerability is remote and requires only network connectivity plus valid authentication credentials, making it exploitable from anywhere an attacker has or can obtain login access. Verify your installed version against the vendor's repository or package manager.

Exploitability

This vulnerability is readily exploitable due to public disclosure and available exploit code. Exploitation requires valid authentication (limiting the attacker pool to insiders, accounts obtained through phishing, or credential compromise), but once authenticated, the attack is straightforward—no special tools, race conditions, or user interaction are needed. The low attack complexity and absence of special configuration requirements mean threat actors with basic shell execution knowledge can leverage this immediately.

Remediation

Upgrade hermes-agent to a patched version beyond 0.15.2. Check the NousResearch GitHub repository or official releases for the latest stable version that addresses this flaw. If an immediate patch is unavailable, consider restricting network access to hermes-agent to trusted internal networks only, reducing the authenticated attacker surface. Apply principle of least privilege to the service account running hermes-agent, limiting the system commands it can execute even if the protection mechanism is bypassed. Monitor for unusual process spawning or command execution originating from the hermes-agent process.

Patch guidance

Consult the NousResearch hermes-agent releases page to identify and deploy a version explicitly patched for this vulnerability (verify that the version number is higher than 0.15.2 and release notes confirm the fix). Test the upgrade in a non-production environment first to ensure compatibility with your workflow configurations. Confirm the patched version resolves the shell.exec restriction by reviewing the tui_gateway/server.py implementation in the release notes or commit history.

Detection guidance

Monitor logs from systems running hermes-agent for unexpected shell.exec invocations, particularly those spawning system commands like bash, sh, or powershell from the service process. Alert on authentication attempts followed by abnormal process execution under the hermes-agent service account. Network-based detection should flag unusual outbound connections initiated by the hermes-agent process to external systems. Endpoint detection and response (EDR) solutions should highlight privilege escalation or persistence attempts originating from hermes-agent's execution context.

Why prioritize this

Although scored as Medium severity, this vulnerability warrants elevated priority due to four factors: (1) publicly available exploit code removes the barrier to weaponization, (2) the vendor did not respond to early disclosure, suggesting delayed or absent patch availability, (3) authentication requirement limits but does not eliminate risk in zero-trust or multi-tenant scenarios, and (4) arbitrary command execution is a critical capability that enables post-exploitation activities. Organizations should treat this as requiring action within weeks, not months.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects the balance between broad impact (confidentiality, integrity, and availability all affected), remote exploitability, and the authentication prerequisite. The Medium rating acknowledges that while the attack is practical and damaging, it is not a perimeter-level zero-day affecting all users. In context, however, the public exploit and unresponsive vendor elevate operational risk beyond the base CVSS number alone.

Frequently asked questions