Description

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalog entry, with no further action required by the operator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-28T20:20:14.470Z",
  "pubdate": "2026-08-28T20:20:14.470Z",
  "executiveSummary": "Hermes Agent versions prior to 0.19.0 contain a critical supply chain vulnerability residing in its bundled MCP catalog.\nThe vulnerability is characterized by the use of mutable branch references for upstream repository dependencies, rather than immutable cryptographic commit SHAs.\nBy compromising a third-party upstream repository, a remote attacker can inject arbitrary malicious code, which is subsequently propagated to all downstream Hermes Agent hosts upon catalog installation or update.\nThis represents a significant supply chain risk, as the exploitation is automated and requires no additional interaction from the operator once the environment is configured to pull from the affected catalog.\nThe attack grants remote code execution capabilities, allowing the adversary to compromise the integrity and confidentiality of the host machine.\nThis vulnerability effectively bypasses traditional security controls by leveraging a trusted update mechanism to deliver a payload.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of dependency versioning within the Hermes Agent MCP (Model Context Protocol) catalog architecture.\nInstead of pinning remote dependencies to specific, immutable commit SHAs, the catalog definitions utilize mutable branch references. This architectural flaw forces the client to dynamically fetch the latest state of the branch from the upstream repository during the catalog update cycle.\nAn attacker who successfully compromises an upstream repository referenced in the MCP catalog can overwrite the contents of the specified branch with malicious logic.\nThe exploitation flow proceeds as follows: First, the attacker gains unauthorized access to the upstream third-party repository. Second, the attacker commits malicious code to the branch tracked by the Hermes Agent MCP catalog. Third, the Hermes Agent host performs an automated update or initialization routine, triggering a fetch operation from the compromised upstream source. Fourth, the Agent pulls the malicious payload, erroneously treating it as an official update because the versioning identifier (the branch name) remains unchanged.\nOnce the payload is pulled, the Hermes Agent executes the included code during the standard operation of the MCP service. Because the Agent operates with the privileges assigned to the service, the attacker achieves arbitrary code execution within the host environment.\nThis attack requires no authentication by the attacker against the target Hermes Agent infrastructure, as the malicious code is pulled through legitimate and expected update channels. The vulnerability is inherently a network-based attack vector, as the Agent's update process relies on external reachability to the compromised third-party repository.\nThe post-exploitation impact is severe, enabling the attacker to perform lateral movement within the network, exfiltrate sensitive data, or install persistent backdoors on the host. Since the exploitation occurs at the supply chain level, traditional file integrity monitoring may be circumvented if the malicious code is signed or appears within a legitimately updated package structure."
}