PT-2026-35969

CVE-2026-7397

Published

2026-04-29

Updated

2026-04-29

Description by

CVSS 3.1

4.4

Medium

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent version 0.8.0

Description A flaw in the check sensitive path() function within the tools/file tools.py file allows for symlink following, which occurs when a program follows a symbolic link to access a file or directory it should not. This issue requires local access for exploitation.

Recommendations Update to version 0.9.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Yu_Bao

Vendors

Affected products

Weakness enumeration

CWE-61: UNIX Symbolic Link (Symlink) Following

CWE-59: Improper Link Resolution Before File Access (\'Link Following\')