CVE-2026-9369: hermes-agent has an Incorrect Comparison

May 26, 2026 (updated June 30, 2026)

A security flaw has been discovered in NousResearch hermes-agent 2026.4.23. Affected is the function _discover_dashboard_plugins of the file hermes_cli/web_server.py of the component CLI web-dashboard Interface. Performing a manipulation of the argument HERMES_ENABLE_PROJECT_PLUGINS results in incorrect comparison. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References

gist.github.com/YLChen-007/062b77ceac6aa9844842a616f5d2ef30
github.com/NousResearch/hermes-agent/commit/09f85f2cf79362a2f7963754b49a44cb3d234176
github.com/advisories/GHSA-cv5c-mh6j-wvp9
nvd.nist.gov/vuln/detail/CVE-2026-9369
vuldb.com/submit/812230
vuldb.com/vuln/365332
vuldb.com/vuln/365332/cti

Code Behaviors & Features

Detect and mitigate CVE-2026-9369 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →