CVE-2026-9354
NousResearch hermes-agent Slack Agent/Mattermost Agent escape output
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
14th
A vulnerability was detected in NousResearch hermes-agent up to 2026.4.16. The affected element is an unknown function of the component Slack Agent/Mattermost Agent. The manipulation of the argument format_message results in escaping of output. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-116 CWE-74 |
| Vendor | nousresearch |
| Product | hermes-agent |
| Published | May 24, 2026 |
| Last Updated | May 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for nousresearch hermes-agent
Be the first to know when new medium vulnerabilities affecting nousresearch hermes-agent are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
NousResearch / hermes-agent
2026.4.0 2026.4.1 2026.4.2 2026.4.3 2026.4.4 2026.4.5 2026.4.6 2026.4.7 2026.4.8 2026.4.9 2026.4.10 2026.4.11 2026.4.12 2026.4.13 2026.4.14 2026.4.15 2026.4.16
References
Credits
🔍 Eric-i (VulDB User) VulDB CNA Team