Description
A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().
Published: 2026-09-03
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Resource Exhaustion
Action: Update
AI Analysis

Impact

A flaw in the resourceBufferFromUrl function of NousResearch hermes‑agent version 0.18.0 allows a remote actor to supply crafted requests that trigger unlimited resource allocation. The omission of bounds checking means the application can consume excessive memory or other system resources, potentially causing slowdown or crash. This type of weakness is identified as CWE‑400 and CWE‑770.

Affected Systems

The affected product is NousResearch hermes‑agent, version 0.18.0. Earlier releases before v2026.8.19 also had the copyImageFromUrl entry point, but newer versions use Electron‑native event.sender.copyImageAt().

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score is not available. The vulnerability is listed as not part of CISA’s KEV catalog. The attack can be started remotely by directing the application to process a malicious URL or payload, but no publicly known exploit is documented. Consequently, the risk is moderate, yet it could lead to denial of service if an attacker repeatedly triggers the allocation behavior.

Generated by OpenCVE AI on September 3, 2026 at 15:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • When a vendor release is published, transition to that version immediately.
  • If no patch is available, limit the exposure of the Electron Main Process by restricting network access or firewall rules to trusted hosts.
  • Continuously monitor system resource usage in the hermes-agent environment to detect anomalous spikes that may indicate exploitation attempts.

Generated by OpenCVE AI on September 3, 2026 at 15:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().
Title NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources
First Time appeared Nousresearch
Nousresearch hermes-agent
Weaknesses CWE-400
CWE-770
CPEs cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*
Vendors & Products Nousresearch
Nousresearch hermes-agent
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Nousresearch Hermes-agent
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-03T13:04:33.914Z

Reserved: 2026-09-03T06:47:17.090Z

Link: CVE-2026-85107

cve-icon Vulnrichment

Updated: 2026-09-03T13:04:31.189Z

cve-icon NVD

Status : Deferred

Published: 2026-09-03T13:06:21.603

Modified: 2026-09-03T17:25:25.113

Link: CVE-2026-85107

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T15:15:05Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling