CVE-2026-18774CWE-918ssrf

CVE-2026-18774

Medium · published August 4, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
27.1
In the wild
Unconfirmed
What it is

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00347 · 27.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-04T21:16Z
References (5)
https://gist.github.com/YLChen-007/7c71603a25d84f372f2275dd570e99d4 · [email protected]https://vuldb.com/cve/CVE-2026-18774 · [email protected]https://vuldb.com/submit/856875 · [email protected]https://vuldb.com/vuln/385784 · [email protected]https://vuldb.com/vuln/385784/cti · [email protected]
EPSS history
Timeline
  • 04 AUG 16:00Z
    NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery
    cvelistv5