Nous Research
Hermes Agent
Open-source AI agent by Nous Research (CLI, Desktop, Docker).
0.23.0
- Release date
- November 05, 2026
- Security status
- 3 high-severity CVEs tracked in the last 90 days. Current version not affected.
Source
GitHub API
Public release notes are linked for the latest stored release.
Release history
See the latest published releases stored for this product.
| Version | Published | Notes |
|---|---|---|
| 0.23.0 | 2026-11-05 | Release Notes |
| 0.22.7 | 2026-11-03 | Release Notes |
| 0.22.6 | 2026-11-02 | Release Notes |
| 0.22.5 | 2026-10-23 | Release Notes |
Vulnerability tracking
versionPing monitors CVEs for this product. Matching CVEs are listed below. We only display CVEs with a CVSS score of 7.0 or higher that were published within the last 90 days.
Affected status is inferred from published affected version ranges where available. Always verify against the vendor advisory before making production decisions.
| CVE | Severity | Published | Status | Summary |
|---|---|---|---|---|
| CVE-2026-71963 | HIGH (8.6) | 2026-09-03 | Current versionnot affected | Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys. Affected versions
|
| CVE-2026-82021 | CRITICAL (9.0) | 2026-08-28 | Current versionnot affected | Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalog entry, with no further action required by the operator. Affected versions
|
| CVE-2026-82020 | HIGH (7.6) | 2026-08-28 | Current versionnot affected | Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages directing the agent's file-write tooling to overwrite the credential store without triggering any path-based protection, enabling credential tampering or unauthorized access. Affected versions
|