CVE-2026-82021

Hermes Agent versions prior to 0.19.0 ship a bundled MCP catalog that references third-party upstream repositories by mutable branch rather than a pinned commit SHA, meaning installed code is not verified against a known-good snapshot (CWE-494, download of code without integrity check). If an attacker compromises one of those upstream repositories, malicious code pushed there is pulled down and executed on every host that installs the affected catalog entry, with no further action required by the operator beyond having installed it. Successful exploitation yields arbitrary code execution with high impact to confidentiality, integrity, and availability, though the attack is conditioned on the attacker first gaining control of the upstream repository (reflected in the high attack-complexity rating). Any deployment running Hermes Agent before 0.19.0 that installs affected catalog entries is exposed. No public proof-of-concept exists, the issue is not in CISA's KEV, and EPSS estimates only a 0.2% chance of exploitation in the next 30 days, so no confirmed in-the-wild exploitation is currently known.

What to do: Upgrade to Hermes Agent 0.19.0 or later, which pins catalog dependencies to commit SHAs for integrity. Until upgraded, avoid installing MCP catalog entries whose upstream references a mutable branch, and audit hosts that already installed such entries for unexpected code or changes, rotating credentials if tampering is suspected. Monitor the upstream repositories referenced by the catalog for signs of compromise.