CVE-2026-18774

Name of the Vulnerable Software and Affected Versions hermes-agent versions prior to 0.16.1

Description A flaw in the xAI Image Generation Provider component allows for remote server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The issue resides within the save url image() function located in the agent/image gen provider.py file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the save url image() function.