CVE-2026-9368 NousResearch hermes-agent Environment Variable code_execution_tool.py execute_code sandbox
Remote attackers can bypass the code execution sandbox in NousResearch hermes-agent to execute arbitrary code and escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9368?
CVE-2026-9368 is a medium-severity code injection vulnerability in NousResearch hermes-agent, published on 24 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Environment Variable Handler. Such manipulation leads to sandbox issue. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2026-9368?
3 open source packages ship an affected version, including hermes-agent.
| Package | Affected | Fixed in |
|---|---|---|
hermes-agent PyPI | All versions | 0.11.0 |
hermes-agent PyPI | All versions | 0.11.0 |
hermes-agent PyPI | All versions | 0.11.0 |
How do I fix CVE-2026-9368?
Upgrade hermes-agent to 0.11.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-9368 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9368 exists.
Sources
Also known as GHSA-wm96-9gfh-vvgq, PYSEC-2026-2515.