CVE-2026-18775: NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery
A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browsersnapshot of the file tools/browsertool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18775?
The severity of CVE-2026-18775 is medium with a score of 6.3.
What is CVE-2026-18775 related to?
CVE-2026-18775 is related to a server-side request forgery vulnerability in the browser_tool.py of the NousResearch hermes-agent.
How can CVE-2026-18775 be exploited?
CVE-2026-18775 can be exploited remotely through manipulation of the browser_snapshot function.
What versions of NousResearch hermes-agent are affected by CVE-2026-18775?
CVE-2026-18775 affects all versions of NousResearch hermes-agent up to and including 0.16.0.
How do I fix CVE-2026-18775?
To fix CVE-2026-18775, update NousResearch hermes-agent to a version beyond 0.16.0.