CVE-2026-85107: NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources
A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. copyImageFromUrl() entry point no longer reachable on current main. That function did exist at v2026.8.3 but was removed by v2026.8.19. The modern copy-image path is Electron-native event.sender.copyImageAt().
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or user interaction?
The supplied vector indicates that no privileges are required, but user interaction is required. The attack may be initiated remotely.
Are builds using the current image-copy implementation exposed through the reported entry point?
The reported copyImageFromUrl() entry point is no longer reachable on the current main branch. The modern image-copy path uses Electron-native event.sender.copyImageAt().
What should be checked when assessing whether a deployment is affected?
Check whether copyImageFromUrl() is reachable in the deployed code. It existed in v2026.8.3 and had been removed by v2026.8.19.