CVE-2026-85106: NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery
Published Sep 3, 2026
·Updated
A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
1 affected component
NousResearch hermes-agent=0.18.0
Event History
Sep 3, 2026
CVE Published
via MITRE·11:45 AM
Data Sourced
via MITRE·11:45 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low privileges. Exploitation can be launched remotely and does not require user interaction.
2
Is vendor remediation information available?
The available data states that the vendor was contacted early about the disclosure but did not respond. No patch or mitigation guidance is provided in the supplied information.