CVE-2026-14783: Hermes-Agent Path Traversal Vulnerability

CVE-2026-14783 Overview

CVE-2026-14783 is a path traversal vulnerability [CWE-22] in NousResearch hermes-agent version 2026.5.29.2. The flaw resides in the skill_view function within tools/skills_tool.py. An attacker can manipulate the Name argument to traverse directories and read files outside the intended skill directory. The attack can be executed remotely and requires only low-level privileges. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse. A patch identified by commit hash 56f833efa427ccb444c0f9ad1759af1012f2124d is available in the upstream repository.

Critical Impact
Remote authenticated attackers can read arbitrary files accessible to the hermes-agent process by supplying crafted path traversal sequences to the skill_view function.

Affected Products

NousResearch hermes-agent 2026.5.29.2
tools/skills_tool.py component (skill_view function)
Deployments exposing the hermes-agent skill interface to network callers

Discovery Timeline

2026-07-06 - CVE-2026-14783 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14783

Vulnerability Analysis

The vulnerability exists in the skill_view function of tools/skills_tool.py within the hermes-agent codebase. The function accepts a Name argument that is used to build a file path for reading skill definitions. Because the input is not properly canonicalized, an attacker can inject relative path components such as ../ to escape the intended skill directory.

Successful exploitation allows reading files outside the skill directory boundary. The Common Weakness Enumeration classifies this issue as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The confidentiality impact is limited to files accessible to the process user, and integrity and availability are not directly affected.

Root Cause

The root cause is the absence of path normalization and boundary enforcement before resolving the Name argument to a filesystem path. The pre-patch code imported only Path from pathlib and did not verify that the resolved path remained within the intended skill directory.

Attack Vector

An attacker with low-privileged access sends a crafted request that supplies a Name value containing traversal sequences. The hermes-agent resolves the untrusted input against a base directory and returns file contents from the traversed location. No user interaction is required.

python

# Patch excerpt from tools/skills_tool.py
 import os
 import re
 from enum import Enum
-from pathlib import Path
+from pathlib import Path, PurePosixPath, PureWindowsPath
 from typing import Dict, Any, List, Optional, Set, Tuple

 from tools.registry import registry, tool_error
# Source: https://github.com/NousResearch/hermes-agent/commit/56f833efa427ccb444c0f9ad1759af1012f2124d
# The fix introduces PurePosixPath and PureWindowsPath to enable cross-platform
# path normalization and boundary validation for the skill_view name argument.

Detection Methods for CVE-2026-14783

Indicators of Compromise

Requests to the hermes-agent skill interface containing ../, ..\, or URL-encoded traversal sequences (%2e%2e%2f) in the Name parameter
Access log entries showing skill_view invocations that reference absolute paths or filenames outside the configured skills directory
Unexpected reads of sensitive files such as /etc/passwd, application configuration files, or .env files by the hermes-agent process

Detection Strategies

Inspect application logs for skill_view calls where the Name argument does not match the allow-listed skill naming convention
Deploy web application firewall rules that flag traversal patterns targeting the hermes-agent endpoint
Monitor process-level file access telemetry for hermes-agent reading files outside its designated skill directory

Monitoring Recommendations

Enable verbose logging of all skill_view invocations, including the raw Name argument and the resolved filesystem path
Alert on any file read by the hermes-agent process that traverses parent directories relative to the configured skills root
Correlate authentication events with subsequent skill lookups to identify low-privileged accounts probing for file access

How to Mitigate CVE-2026-14783

Immediate Actions Required

Apply upstream commit 56f833efa427ccb444c0f9ad1759af1012f2124d from the NousResearch hermes-agent repository
Restrict network exposure of the hermes-agent so only trusted, authenticated clients can reach the skill interface
Audit historical logs for traversal patterns in the Name argument to identify prior exploitation attempts

Patch Information

The fix is delivered in commit 56f833efa427ccb444c0f9ad1759af1012f2124d, referenced by GitHub Pull Request #40566 and GitHub Issue #38643. The patch imports PurePosixPath and PureWindowsPath to normalize input across operating systems and enforce that resolved paths remain within the skill directory. Additional details are available at VulDB CVE-2026-14783.

Workarounds

Place the hermes-agent behind an authenticating reverse proxy that strips or rejects traversal sequences in query and body parameters
Run the hermes-agent process as an unprivileged user with filesystem access restricted to the skills directory
Apply mandatory access controls such as AppArmor or SELinux profiles to confine hermes-agent file reads to the skills directory

bash

# Example AppArmor confinement snippet limiting hermes-agent file reads
/opt/hermes-agent/skills/** r,
deny /etc/** r,
deny /home/** r,
deny /root/** r,