{"action":"Upgrade hermes-agent to 0.16.0 or later.","affected":[{"fixed":"0.16.0","introduced":"0"}],"component":"hermes-agent","cve_ids":["CVE-2026-53870"],"ecosystem":"PyPI","epss":0.0016,"exploited":false,"fixed_versions":["0.16.0"],"ghsa_id":"GHSA-99f9-j8r3-p853","id":"tcs_01M5KGZXS4MKKMQAASGVFYV57V","modified_at":"2026-07-13T16:31:56.301521107Z","published_at":"2026-07-13T15:46:20.291382Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2511","https://nvd.nist.gov/vuln/detail/CVE-2026-53870","https://github.com/NousResearch/hermes-agent/pull/30917","https://github.com/NousResearch/hermes-agent/pull/31469","https://github.com/NousResearch/hermes-agent/commit/3bace071bfadf2d2bec2ee048471a31ec920e3e8","https://github.com/NousResearch/hermes-agent","https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5","https://www.vulncheck.com/advisories/hermes-agent-sensitive-file-permission-vulnerability-in-store-files","https://pypi.org/project/hermes-agent","https://github.com/advisories/GHSA-99f9-j8r3-p853"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-2511","url":"https://osv.dev/vulnerability/PYSEC-2026-2511"}],"summary":"Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)"}