Description

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-03T13:06:21.603Z",
  "pubdate": "2026-09-03T13:06:21.603Z",
  "executiveSummary": "A resource allocation vulnerability exists in the NousResearch hermes-agent version 0.18.0 within the Electron Main Process.\nThe flaw specifically resides in the resourceBufferFromUrl function located in apps/desktop/electron/main.ts, which is susceptible to uncontrolled resource consumption.\nThis vulnerability allows remote attackers to trigger the allocation of system resources by manipulating input processed by the vulnerable function.\nSuccessful exploitation may lead to a Denial of Service (DoS) condition due to resource exhaustion in the Electron-based desktop application.\nThe vulnerability is remotely exploitable, posing a significant risk to system stability and availability.\nThe legacy copyImageFromUrl entry point has been deprecated and replaced by the Electron-native event.sender.copyImageAt() method, which is not subject to this specific vulnerability.",
  "technicalDetails": "The vulnerability is situated within the Electron Main Process of the hermes-agent 0.18.0, specifically impacting the logic encapsulated in the resourceBufferFromUrl function within the apps/desktop/electron/main.ts file.\nThe root cause of the vulnerability is the improper handling of resource requests when processing URLs, which lacks adequate validation or constraints on the size or quantity of resources requested. When an attacker provides a crafted URL, the function initiates a request to the specified resource, leading to uncontrolled memory or handle allocation within the Electron main process context.\nThe attack flow begins when an attacker remotely initiates an interaction that triggers the resourceBufferFromUrl function with a malicious payload. Because the function does not implement strict rate limiting, input validation, or size thresholds, the application proceeds to allocate system resources to buffer the external content fetched from the attacker-supplied URL.\nContinued exploitation involves flooding the application with requests designed to exceed the available memory or file descriptor limits of the host environment. By rapidly invoking the vulnerable function, an attacker can induce resource exhaustion, resulting in the instability or crash of the Electron-based application.\nThe exposure is network-based, as the entry point accepts external inputs, requiring no prior authentication or local privileges to initiate. While the legacy copyImageFromUrl function has been removed—superseded by the more secure and native event.sender.copyImageAt()—the presence of the vulnerable resourceBufferFromUrl function continues to present a significant attack surface in the 0.18.0 release.\nPost-exploitation, the primary impact is a Denial of Service. The application may become unresponsive or terminate unexpectedly, potentially causing data loss or process interference on the affected host machine. The lack of bounds checking on the content fetched during the resource buffering process remains the critical technical deficit enabling this behavior."
}