CVE-2026-7397CWE-59CWE-61

NousResearch hermes-agent file_tools.py _check_sensitive_path symlink

Medium · published April 29, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
6.3
In the wild
Unconfirmed
What it is

A security flaw has been discovered in NousResearch hermes-agent 0.8.0. This affects the function _check_sensitive_path of the file tools/file_tools.py. The manipulation results in symlink following. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.9.0 is able to mitigate this issue. The patch is identified as 311dac197145e19e07df68feba2cd55d896a3cd1. Upgrading the affected component is recommended.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00172 · 6.3th percentile
Weaknesses
CWE-59 · Improper Link Resolution Before File Access ('Link Following'); CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-04-29T18:00Z
EPSS history
Timeline
  • 29 APR 18:00Z
    NousResearch hermes-agent file_tools.py _check_sensitive_path symlink
    cvelistv5