CVE-2026-7396CWE-22

NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal

Medium · published April 29, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
52.2
In the wild
Unconfirmed
What it is

A vulnerability was identified in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/wecom.py of the component WeChat Work Platform Adapter. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00690 · 52.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-29T17:30Z
EPSS history
Timeline
  • 29 APR 17:30Z
    NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal
    cvelistv5