CVE-2026-7396: NousResearch hermes-agent WeChat Work Platform Adapter wecom.py path traversal

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-29 · updated 2026-06-17
Weakness: CWE-22

Description

A vulnerability was identified in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/wecom.py of the component WeChat Work Platform Adapter. The manipulation leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Affected products

NousResearch hermes-agent: 0.8.0

References

https://github.com/NousResearch/hermes-agent/
https://github.com/NousResearch/hermes-agent/issues/8733
https://github.com/bugmaker2/hermes-agent/issues/29
https://vuldb.com/submit/803269
https://vuldb.com/vuln/360120
https://vuldb.com/vuln/360120/cti

Get alerted when CVE-2026-7396 or the next vulnerability affects your stack