CVE-2026-18774

Description

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Overview

State: PUBLISHED
Assigner (CNA): VulDB
CVSS severity: MEDIUM
CVSS score: 5.3 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Effective score: 5.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-918
Reserved: 2026-08-04
Published: 2026-08-04 16:00 UTC
Last updated: 2026-08-04 16:00 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18774.json

Affected products (1)

Vendor	Product	Versions	Platforms
NousResearch	hermes-agent	`0.1` (affected), `0.2` (affected), `0.3` (affected), `0.4` (affected), `0.5` (affected), `0.6` (affected), `0.7` (affected), `0.8` (affected), `0.9` (affected), `0.10` (affected), `0.11` (affected), `0.12` (affected), `0.13` (affected), `0.14` (affected), `0.15` (affected), `0.16.0` (affected)	—

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

VDB-385784 | NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery vdb-entrytechnical-description
VDB-385784 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
CVE-2026-18774 | CVE Analysis and Report third-party-advisory
Submit #856875 | NousResearch hermes-agent 0.16.0 Server-Side Request Forgery (CWE-918) third-party-advisory
https://gist.github.com/YLChen-007/7c71603a25d84f372f2275dd570e99d4 exploit

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-18774.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "xAI Image Generation Provider"
          ],
          "product": "hermes-agent",
          "vendor": "NousResearch",
          "versions": [
            {
              "status": "affected",
              "version": "0.1"
            },
            {
              "status": "affected",
              "version": "0.2"
            },
            {
              "status": "affected",
              "version": "0.3"
            },
            {
              "status": "affected",
              "version": "0.4"
            },
            {
              "status": "affected",
              "version": "0.5"
            },
            {
              "status": "affected",
              "version": "0.6"
            },
            {
              "status": "affected",
              "version": "0.7"
            },
            {
              "status": "affected",
              "version": "0.8"
            },
            {
              "status": "affected",
              "version": "0.9"
            },
            {
              "status": "affected",
              "version": "0.10"
            },
            {
              "status": "affected",
              "version": "0.11"
            },
            {
              "status": "affected",
              "version": "0.12"
            },
            {
              "status": "affected",
              "version": "0.13"
            },
            {
              "status": "affected",
              "version": "0.14"
            },
            {
              "status": "affected",
              "version": "0.15"
            },
            {
              "status": "affected",
              "version": "0.16.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Eric-y (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T16:00:11.053Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-385784 | NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/385784"
        },
        {
          "name": "VDB-385784 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/385784/cti"
        },
        {
          "name": "CVE-2026-18774 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-18774"
        },
        {
          "name": "Submit #856875 | NousResearch hermes-agent 0.16.0 Server-Side Request Forgery (CWE-918)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/856875"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/YLChen-007/7c71603a25d84f372f2275dd570e99d4"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-04T09:40:51.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-18774",
    "datePublished": "2026-08-04T16:00:11.053Z",
    "dateReserved": "2026-08-04T07:35:41.048Z",
    "dateUpdated": "2026-08-04T16:00:11.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}