Description
A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-03
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the fetchLinkTitle function within the Link Title Fetch component of NousResearch's hermes‑agent. By manipulating the URL parameter, an attacker can cause the server to issue HTTP requests to arbitrary destinations. This behavior enables a server-side request forgery attack that could expose internal network resources, bypass authentication, or exfiltrate data. The weakness is a classic SSRF flaw (CWE‑918).

Affected Systems

The flaw affects the 0.18.0 release of NousResearch's hermes‑agent. Administrators of this version should identify installations of hermes‑agent where the Link Title Fetch feature is enabled, as the vulnerable function is part of the desktop application artifact component.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity risk. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. An attacker can launch the exploit remotely by supplying a crafted URL without requiring authentication, making it a straightforward SSRF attack. While the impact is limited to the agent’s outbound network reach, it still poses a significant threat to internal infrastructure.

Generated by OpenCVE AI on September 3, 2026 at 13:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available official patch or upgrade to a secured release of hermes‑agent.
  • If a patch is unavailable, disable or restrict the fetchLinkTitle feature by removing or commenting out the function call, or by limiting its input to a whitelist of trusted domains.
  • Configure outbound request filtering or firewall rules to block the agent from accessing arbitrary URLs not on the whitelist.
  • Monitor outbound traffic for unauthorized or unexpected connections originating from hermes‑agent.

Generated by OpenCVE AI on September 3, 2026 at 13:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 12:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery
First Time appeared Nousresearch
Nousresearch hermes-agent
Weaknesses CWE-918
CPEs cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*
Vendors & Products Nousresearch
Nousresearch hermes-agent
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:ND'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Nousresearch Hermes-agent
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-03T11:45:06.827Z

Reserved: 2026-09-03T06:47:13.943Z

Link: CVE-2026-85106

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-03T13:06:21.437

Modified: 2026-09-03T13:06:21.437

Link: CVE-2026-85106

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T13:45:04Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)