CVE-2026-18775

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent versions prior to 0.16.1

Description A flaw in the Browser Tooling component allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The issue resides in the browser snapshot() function within the tools/browser tool.py file and can be exploited remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the browser snapshot() function.