5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9368

CVE-2026-9368: hermes-agent has a sandbox issue

A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Environment Variable Handler. Such manipulation leads to sandbox issue. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9368

CVE-2026-9368:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hermes-agent	pip	< 0.11.0	0.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as a sandbox issue, is located in the execute_code function within tools/code_execution_tool.py. This function is responsible for executing untrusted code. The provided patch, commit 285bb2b9150b93445e5eded9bc897a4001b66e55, fundamentally alters the execution environment of this function. Previously, it attempted to use a temporary directory and the system's Python executable to create a sandbox, but this was found to be insecure. The patch introduces two modes: 'strict' (the old, insecure behavior) and 'project' (the new default). The 'project' mode runs code in the user's current project directory with their configured Python environment. This change, along with new functions to resolve the child process's executable and working directory, is the mitigation. The core vulnerability is the insufficient sandboxing within the original execute_code function, which could be exploited to break out of the intended isolated environment. The patch evidence clearly shows the change in the subprocess.Popen call, which is central to the execution of the code and the setup of the environment.

Vulnerable functions

execute_code

tools/code_execution_tool.py

The `execute_code` function is responsible for running Python code in a subprocess. The vulnerability lies in the fact that the sandboxed environment it created was not secure, allowing for a sandbox escape. The patch changes how the subprocess is created, by introducing configurable execution modes ('strict' and 'project') that determine the Python interpreter and working directory used for execution. The vulnerability existed in the original implementation of this function which tried to create a sandbox but failed to do so securely.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.