CVE-2026-18774: NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery
A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function saveurlimage of the file agent/imagegenprovider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18774?
The severity of CVE-2026-18774 is classified as medium, with a score of 6.3.
How does CVE-2026-18774 affect systems?
CVE-2026-18774 allows for server-side request forgery, which can lead to unauthorized access to internal resources.
How do I fix CVE-2026-18774?
To fix CVE-2026-18774, update the NousResearch hermes-agent to a version later than 0.16.0.
What is the impact of exploiting CVE-2026-18774?
Exploiting CVE-2026-18774 can result in unauthorized data exposure and potential control over internal systems.
Is CVE-2026-18774 vulnerable to remote attacks?
Yes, the vulnerability CVE-2026-18774 can be exploited remotely.