CVE-2026-9351: NousResearch hermes-agent read_file Tool file_tools.py _is_blocked_device path traversal
A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.16. This vulnerability affects the function isblockeddevice of the file tools/filetools.py of the component readfile Tool. Performing a manipulation results in path traversal. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9351?
CVE-2026-9351 has a medium severity rating of 6.5.
How do I fix CVE-2026-9351?
To fix CVE-2026-9351, update to the latest version of NousResearch hermes-agent that addresses the path traversal vulnerability.
What is affected by CVE-2026-9351?
CVE-2026-9351 affects the _is_blocked_device function in the file tools/file_tools.py of NousResearch hermes-agent.
Can CVE-2026-9351 be exploited remotely?
Yes, CVE-2026-9351 can be exploited remotely due to its nature of path traversal.
What type of vulnerability is CVE-2026-9351 classified as?
CVE-2026-9351 is classified as a path traversal vulnerability.