VulnSocial

CVE-2026-9367Disclosure

LOWCVSS 5.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect_dangerous_command of the file tools/approval.py of the component terminal_tool. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-77CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-05-24); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-24: 1Mentions · 2026-06-13: 1Patch / Workaround · 2026-06-13: 105-2406-13
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-05-241
Disclosure1
2026-06-131
General1
Full discourse2 posts
  • USTech.Ninja | Your Personal Ninja@ustechninja
    General

    AI agents without guardrails? That’s the YOLO problem. CVE-2026-9367 proves the risk. Use a No-YOLO strategy: sandboxing + human oversight. Stay safe with http://USTech.Ninja. https://www.ustech.ninja/the-yolo-problem-why-ai-automation-needs-guardrails/ #AI https://t.co/jBh83KAUJn

    Post summary

    The tweet references CVE‑2026‑9367 but offers no detailed vulnerability, exploit, or patch information, only a general risk warning and basic mitigation advice.

    0000034
    59 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-9367 A vulnerability was determined in NousResearch hermes-agent up to 5157f5427f19488b31c6fdebbacd15d798ce7f63. This affects the function detect_dangerous_command of the fi… https://www.cve.org/CVERecord?id=CVE-2026-9367

    Post summary

    CVE-2026-9367 was identified in the NousResearch hermes‑agent (up to a specific commit) and affects the detect_dangerous_command function, but no PoC, exploit, patch, or active exploitation evidence is provided.

    00000190
    57.5K followersView on X

Explore more

Back to dashboard