CVE-2026-14628

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent versions prior to 2026.5.17

Description A path traversal issue exists in the Live Webhook Endpoint component within the extract media() function of the gateway/platforms/base.py file. This flaw allows a remote attacker to perform a manipulation that enables access to files or directories outside the intended folder.

Recommendations Update to a version later than 2026.5.16. As a temporary workaround, restrict access to the extract media() function until a patch is applied.