CVE-2026-82021
Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalog entry, with no further action required by the operator.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS probability
- 0.23%
- CWE
- CWE-494
- Published
- 2026-08-28
- Last modified
- 2026-08-31
Affected products
- NousResearch hermes-agent
- NousResearch hermes-agent
Weakness type
Related vulnerabilities
- CVE-2026-79963 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-62654 — A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance...
- CVE-2026-85427 — MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE
- CVE-2026-21810 — HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking
- CVE-2026-65081 — NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker...
- CVE-2026-65097 — NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker...
- CVE-2026-57910 — WatchGuard Agent improper authentication allows unauthenticated remote code execution
- CVE-2026-63310 — NLTK before 3.9.3 Missing Post-Download Integrity Verification