hermes-agent 0.15.0

Direct Vulnerabilities

Known vulnerabilities in the hermes-agent package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Missing Authentication for Critical Function hermes-agent is a The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the handling of WebSocket upgrade requests on `/api/pty`, `/api/ws`, `/api/pub`, and `/api/events` endpoints due to the FastAPI HTTP middleware not executing for these requests. An attacker can bypass access controls by exploiting DNS rebinding, which may allow the injection of malicious commands or reading of terminal output. How to fix Missing Authentication for Critical Function? Upgrade `hermes-agent` to version 0.16.0 or higher.	[,0.16.0)
M Incorrect Default Permissions hermes-agent is a The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere Affected versions of this package are vulnerable to Incorrect Default Permissions due to the creation of `response_store.db` and `webhook_subscriptions.json` files with world-readable permissions. An attacker can access sensitive data, such as conversation history, tool payloads, prompts, and HMAC secrets, by reading these files directly if they have local filesystem access. How to fix Incorrect Default Permissions? Upgrade `hermes-agent` to version 0.16.0 or higher.	[,0.16.0)

Vulnerability

Vulnerable Version

Missing Authentication for Critical Function

hermes-agent is a The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere

Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the handling of WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints due to the FastAPI HTTP middleware not executing for these requests. An attacker can bypass access controls by exploiting DNS rebinding, which may allow the injection of malicious commands or reading of terminal output.

How to fix Missing Authentication for Critical Function?

Upgrade hermes-agent to version 0.16.0 or higher.

[,0.16.0)

Incorrect Default Permissions

hermes-agent is a The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere

Affected versions of this package are vulnerable to Incorrect Default Permissions due to the creation of response_store.db and webhook_subscriptions.json files with world-readable permissions. An attacker can access sensitive data, such as conversation history, tool payloads, prompts, and HMAC secrets, by reading these files directly if they have local filesystem access.

How to fix Incorrect Default Permissions?

Upgrade hermes-agent to version 0.16.0 or higher.

[,0.16.0)

hermes-agent@0.15.0

The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically