CVE-2026-14783: Path Traversal in NousResearch hermes-agent 2026.5.29.2

Technical summary

CVE-2026-14783 is a path traversal vulnerability (CWE-22) in the skill_view function of tools/skills_tool.py within NousResearch hermes-agent 2026.5.29.2. The flaw stems from insufficient input validation on the Name parameter, enabling directory traversal sequences to bypass intended access controls. The vulnerability is remotely exploitable and requires authentication (PR:L). Successful exploitation results in confidentiality impact through unauthorized file disclosure. The fix is available in commit 56f833efa427ccb444c0f9ad1759af1012f2124d.

Business impact

If exploited, this vulnerability could expose sensitive configuration files, credentials, or proprietary data stored on hermes-agent systems. For organizations using hermes-agent in production environments, unauthorized file access could lead to secondary attacks, compliance violations (especially in regulated industries), or information leakage. The impact is contained by the authentication requirement—threat actors must first obtain valid credentials—but represents meaningful risk to the confidentiality of stored information.

Affected systems

NousResearch hermes-agent version 2026.5.29.2 is directly affected. Organizations should inventory all deployments of this specific version and verify whether earlier or later versions have been tested for similar issues. Given the focused version identifier, patch testing should confirm the fix's presence in any updated builds.

Exploitability

The vulnerability has been publicly disclosed, increasing the likelihood of active exploitation. It requires network access and valid user credentials, which moderates immediate risk compared to unauthenticated flaws. However, the straightforward nature of path traversal attacks and the availability of public disclosure mean that motivated attackers with even low-privilege accounts can attempt exploitation. The CVSS score of 4.3 (MEDIUM) reflects the authentication barrier; without it, the severity would be higher.

Remediation

Apply the patch containing commit 56f833efa427ccb444c0f9ad1759af1012f2124d to hermes-agent installations. Verify the specific patched version number against the NousResearch advisory before deployment. Additionally, implement access controls restricting skill_view functionality to necessary users and consider input validation hardening at the application layer.

Patch guidance

Obtain the patched version from NousResearch's official repository or release channels. Verify the commit hash 56f833efa427ccb444c0f9ad1759af1012f2124d is present in the patched build. Test thoroughly in a staging environment before production rollout, paying particular attention to legitimate skill name resolution to avoid functional regressions. Document the patching timeline for compliance records.

Detection guidance

Monitor for suspicious file access patterns in hermes-agent logs, particularly attempts to access files outside expected directories using path traversal sequences (e.g., '../', '..\', URL-encoded variants). Alert on repeated failed or successful skill_view requests with unusual Name parameters. Network-level detection should flag POST/GET requests to the skills endpoint with encoded traversal characters. Check file access logs for unexpected reads from sensitive directories by the hermes-agent process.

Why prioritize this

Although CVSS 4.3 is MEDIUM severity, the public disclosure status and authentication-only barrier warrant timely but not emergency-tier response. Prioritize this based on your environment: systems with elevated privileges, those storing sensitive data, or those accessible to untrusted users should be patched first. Non-critical development or isolated test systems may follow lower priority queues.

Risk score, explained

The CVSS 4.3 score reflects a remotely exploitable path traversal with authenticated access required (PR:L), resulting in low confidentiality impact (C:L) but no integrity or availability impact. The low score is primarily due to the authentication prerequisite; if an attacker already has valid credentials, the barrier to file disclosure is minimal. Organizations should weight this against their own threat model—credential compromise or insider threats increase practical risk beyond the base score.

Frequently asked questions