CVE-2026-18775 | NousResearch hermes-agent up to 0.16.0 Browser Tooling tools/browser_tool.py browser_snapshot server-side request forgery

A vulnerability classified as critical was found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser_snapshot of the file tools/browser_tool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery.

This vulnerability is traded as CVE-2026-18775. The attack may be launched remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.