NousResearch hermes-agent CLI web-dashboard web_server.py _discover_dashboard_plugins comparison

Vulnerability

The vulnerability exists in hermes_cli/web_server.py at line 2630 in NousResearch hermes-agent version 2026.4.23. The function _discover_dashboard_plugins() uses os.environ.get("HERMES_ENABLE_PROJECT_PLUGINS") to check whether project-level dashboard plugins should be loaded. Because a non-empty string (such as "false" or "0") is truthy in Python, this evaluation bypasses the intended security gating. The correct check, which safely interprets string booleans, is implemented in utils.env_var_enabled() (used in hermes_cli/plugins.py:561) but is not used in the web server path. This allows an attacker who can place a malicious plugin (e.g., dashboard/manifest.json pointing to an api.py payload) inside a repository being processed by Hermes to have the plugin loaded even when the user explicitly set HERMES_ENABLE_PROJECT_PLUGINS=false to disable project plugins [1].

Exploitation

Exploitation requires local access to a system where a user will run the Hermes dashboard (hermes --web) or import hermes_cli.web_server in a directory containing a repository controlled by the attacker. The attacker creates a malicious project plugin structure (e.g., .hermes/plugins/malicious/dashboard/manifest.json) inside a repository. The manifest references an api.py Python module that contains malicious code. When the user starts the dashboard, the flawed environment variable check evaluates "false" as truthy, enabling project plugins. The _discover_dashboard_plugins() function then imports the payload module via _mount_plugin_api_routes(), causing immediate code execution with no prior authentication [1].

Impact

Successful exploitation leads to remote code execution (RCE) in the context of the user running Hermes. An attacker can perform arbitrary actions available to that user, including file access, data exfiltration, and further system compromise. The vulnerability is publicly disclosed with proof-of-concept code, raising the likelihood of widespread exploitation [1].

Mitigation

As of the publication date (2026-05-24), the vendor (NousResearch) has not responded to disclosure and no patched version has been released. Users should not rely on the HERMES_ENABLE_PROJECT_PLUGINS environment variable for security; instead, avoid running the Hermes dashboard in untrusted repositories or audit repositories for malicious .hermes/plugins directories before use. The vulnerability is not listed in CISA KEV as of this writing [1].