CVE-2026-14625: NousResearch hermes-agent server.py shell.exec protection mechanism
A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element is the function shell.exec of the file tuigateway/server.py. The manipulation results in protection mechanism failure. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14625?
The severity of CVE-2026-14625 is medium with a score of 6.3.
How do I fix CVE-2026-14625?
To fix CVE-2026-14625, you should update the NousResearch hermes-agent to version 0.15.3 or later.
What type of attack can be executed using CVE-2026-14625?
CVE-2026-14625 allows for remote exploitation of the shell.exec function, potentially leading to a protection mechanism failure.
Is CVE-2026-14625 relevant to all versions of NousResearch hermes-agent?
Yes, CVE-2026-14625 affects all versions of NousResearch hermes-agent up to 0.15.2.
What is the potential impact of exploiting CVE-2026-14625?
Exploiting CVE-2026-14625 can lead to unauthorized command execution and could compromise system integrity.