6 matches found
CVE-2026-82021
Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...
EUVD-2026-67867
Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...
CVE-2026-82021 Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference
Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...
CVE-2026-82021 Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference
Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromis...
CVE-2026-82021
Hermes Agent versions 0.18.2 prior to 0.19.0 contain a supply chain vulnerability in its bundled MCP catalog . A third-party upstream repository is referenced via a mutable branch rather than a pinned commit SHA, meaning an attacker who compromises that upstream repository can propagate malicious...
PT-2026-83284
Name of the Vulnerable Software and Affected Versions Hermes Agent versions 0.18.2 through 0.18.x Description A supply chain issue exists in the bundled MCP catalog. A remote attacker can execute arbitrary code by compromising a third-party upstream repository that is referenced via a mutable...