CVE-2026-18774— NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| NousResearch | hermes-agent | 0.1 | affected |
0.2 | affected | ||
0.3 | affected | ||
0.4 | affected | ||
0.5 | affected | ||
0.6 | affected | ||
0.7 | affected | ||
0.8 | affected | ||
| … +8 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-18774
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NousResearch | hermes-agent | 0.1 | cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-18774
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18774
请登录查看更多情报信息。
Proof of Concept for CVE-2026-18774 (1)
Same Patch Batch · NousResearch · 2026-08-04 · 3 CVEs total
| CVE-2026-18773 | 6.3 MEDIUM | NousResearch hermes-agent Quick run.py _check_slash_access authorization |
| CVE-2026-18775 | 6.3 MEDIUM | NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side req |
IV. Related Vulnerabilities
Same product: hermes-agent
- CVE-2026-18775
NousResearch hermes-agent Browser Tooling browser_tool.py br - CVE-2026-18773
NousResearch hermes-agent Quick run.py _check_slash_access a - CVE-2026-17432
NousResearch hermes-agent SimpleX Gateway Authorization adap - CVE-2026-15311
NousResearch hermes-agent Matrix Adapter matrix.py MatrixAda - CVE-2026-14783
NousResearch hermes-agent skills_tool.py skill_view path tra
Same vendor: NousResearch
- CVE-2026-18775
NousResearch hermes-agent Browser Tooling browser_tool.py br - CVE-2026-18773
NousResearch hermes-agent Quick run.py _check_slash_access a - CVE-2026-17432
NousResearch hermes-agent SimpleX Gateway Authorization adap - CVE-2026-15311
NousResearch hermes-agent Matrix Adapter matrix.py MatrixAda - CVE-2026-14783
NousResearch hermes-agent skills_tool.py skill_view path tra
Same weakness: CWE-918
- CVE-2026-9081
Langflow OSS is affected by server-side request forgery in p - CVE-2026-7657
Langflow OSS is affected by server-side request forgery in p - CVE-2026-17617
Server-Side Request Forgery (SSRF) in IBM Application Gatewa - CVE-2026-70605
Electron: HTTP redirect followed into local file loader - CVE-2026-9203
Server-side request forgery in Progress MarkLogic Server
V. Comments for CVE-2026-18774
No comments yet