CVE-2026-7397

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in NousResearch hermes-agent 0.8.0. This affects the function _check_sensitive_path of the file tools/file_tools.py. The manipulation results in symlink following. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.9.0 is able to mitigate this issue. The patch is identified as 311dac197145e19e07df68feba2cd55d896a3cd1. Upgrading the affected component is recommended.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-59 CWE-61

Affected software

No affected versions have been published.

Timeline

Published: Apr 29, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-739735.5Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/lo CVE-2026-739745.5linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plug CVE-2026-739758.4djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject a CVE-2026-739767.1djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject CVE-2026-73987.3A weakness has been identified in florensiawidjaja BioinfoMCP up to 7ada7918b9e515604d3c0ae264d3a9af10bf6e54. This vulnerability affects the CVE-2026-73998.1Authorization bypass through User-Controlled key vulnerability in MeWare Software Development Inc. PDKS allows Privilege Abuse. This issue CVE-2026-739929.9Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.CVE-2026-739939.8Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.CVE-2026-739947.5Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.CVE-2026-739955.4Subscriber Broken Authentication in User Registration <= 5.2.6 versions.CVE-2026-739969.8Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.CVE-2026-739977.5Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.