Description

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-03T13:06:21.437Z",
  "pubdate": "2026-09-03T13:06:21.437Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in the 'Link Title Fetch' component of NousResearch hermes-agent version 0.18.0.\nThe vulnerability resides within the fetchLinkTitle function located in apps/desktop/src/app/artifacts/index.tsx.\nThe flaw allows an unauthenticated remote attacker to manipulate the 'url' argument, forcing the application to perform unauthorized HTTP requests to arbitrary destinations, including internal network resources or local services.\nThe impact includes potential unauthorized information disclosure, scanning of internal infrastructure, and bypass of firewall restrictions.\nThis vulnerability is critical due to the ease of remote exploitation and the potential for lateral movement within the hosting environment.\nThe vendor has been notified of this vulnerability but has provided no response, leaving current deployments of version 0.18.0 exposed.",
  "technicalDetails": "The vulnerability is caused by improper validation of user-supplied input provided to the 'url' argument within the fetchLinkTitle function in apps/desktop/src/app/artifacts/index.tsx.\nThe application processes the input URL to retrieve metadata, specifically the page title, without implementing a robust allow-list or performing validation against internal IP ranges (e.g., 127.0.0.1, 169.254.169.254, or private RFC 1918 subnets).\nExploitation occurs when an attacker crafts a malicious request containing a controlled URI scheme or host. Because the application logic fails to sanitize or restrict the input before passing it to the underlying request-making client, the server performs a request on behalf of the attacker.\nThe attack flow proceeds as follows: 1) The attacker identifies an interface or endpoint that triggers the fetchLinkTitle function. 2) The attacker submits a malicious 'url' parameter pointing to an internal resource, such as 'http://localhost:8080/admin' or an internal metadata service. 3) The server-side code executes an outbound request to the specified resource. 4) The server receives the response from the internal destination, potentially leaking sensitive metadata or content back to the attacker if the response or result is reflected in the UI or logs.\nThis SSRF vector allows the attacker to circumvent network boundaries, interact with services that lack external authentication, and perform port scanning of the local environment. Since the operation is conducted via the application's service account, it assumes the network privileges of the hosting environment.\nNo specific authentication or user privileges are required to reach the vulnerable function, as the 'Link Title Fetch' component is exposed to remote interaction, enabling unauthenticated remote exploitation.\nPost-exploitation impact includes the ability to exfiltrate internal configuration data, interact with locally hosted APIs, or potentially trigger state-changing actions on internal services that trust requests originating from 'localhost'.\nThe vulnerability specifically affects NousResearch hermes-agent version 0.18.0 and remains unpatched."
}