CVE-2026-53870
2 advisories.
PyPI/hermes-agent CVE-2026-53870: medium 5.5
Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)
Action: Upgrade hermes-agent to 0.16.0 or later.
pip install hermes-agent==0.16.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.16.0 | - |
Fixed versions
| 0.16.0 |
Sources
- osv: GHSA-99f9-j8r3-p853
- https://nvd.nist.gov/vuln/detail/CVE-2026-53870
- https://github.com/NousResearch/hermes-agent/pull/30917
- https://github.com/NousResearch/hermes-agent/pull/31469
- https://github.com/NousResearch/hermes-agent/commit/3bace071bfadf2d2bec2ee048471a31ec920e3e8
- https://github.com/NousResearch/hermes-agent
- https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5
- https://www.vulncheck.com/advisories/hermes-agent-sensitive-file-permission-vulnerability-in-store-files
CVE-2026-53870 · published · modified · JSON
PyPI/hermes-agent CVE-2026-53870: medium 5.5
Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)
Action: Upgrade hermes-agent to 0.16.0 or later.
pip install hermes-agent==0.16.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.16.0 | - |
Fixed versions
| 0.16.0 |
Sources
- osv: PYSEC-2026-2511
- https://nvd.nist.gov/vuln/detail/CVE-2026-53870
- https://github.com/NousResearch/hermes-agent/pull/30917
- https://github.com/NousResearch/hermes-agent/pull/31469
- https://github.com/NousResearch/hermes-agent/commit/3bace071bfadf2d2bec2ee048471a31ec920e3e8
- https://github.com/NousResearch/hermes-agent
- https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5
- https://www.vulncheck.com/advisories/hermes-agent-sensitive-file-permission-vulnerability-in-store-files
- https://pypi.org/project/hermes-agent
- https://github.com/advisories/GHSA-99f9-j8r3-p853
CVE-2026-53870 · published · modified · JSON