CVE-2026-18775
Received Received - Intake

Server-Side Request Forgery in NousResearch Hermes-Agent

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulDB

Description
A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser_snapshot of the file tools/browser_tool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-18775
EUVD
EUVD-2026-52766

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nousresearch hermes-agent to 0.16.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18775 is a vulnerability in the Hermes browser tooling component of the hermes-agent package up to version 0.16.0. It allows server-side request forgery by bypassing private-network access restrictions. An attacker can use the browser_console function to change the main frame location to internal or loopback addresses, then capture sensitive content via browser_snapshot despite policy protections.

Detection Guidance

Check if the hermes-agent package version 0.16.0 or earlier is installed using package managers like pip or npm. Inspect browser tooling logs for suspicious navigation attempts or JavaScript console usage that changes main-frame locations to internal targets.

Impact Analysis

If you use hermes-agent with browser tooling, an attacker with access to browser tools could exploit this to read sensitive internal or localhost-only content. This includes accessing private web pages, APIs, or services running on your local network that were not intended to be exposed publicly.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, potentially violating GDPR (data protection), HIPAA (health information), or other privacy regulations. Unauthorized access to internal content may result in data breaches, compliance violations, and legal consequences depending on the data accessed.

Mitigation Strategies

Upgrade hermes-agent to a version beyond 0.16.0 if available. Disable or restrict access to browser tooling functions like browser_console() and browser_snapshot(). Implement network policies to block unauthorized internal URL access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18775. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart