Hermes Agent Supply Chain Vulnerability via Mutable MCP Catalog References

Hermes Agent versions 0.18.2 and earlier are susceptible to a supply chain attack involving the agent's bundled MCP catalog. The configuration relies on mutable branch names to fetch dependencies from upstream repositories rather than using pinned commit SHAs. This design choice creates a window of opportunity for attackers who compromise an upstream repository to inject malicious payloads directly into the catalog. When the Hermes Agent performs its update or installation sequence, it automatically pulls and executes the compromised code. Because this process occurs without user interaction or signature validation, the compromise can silently propagate to any host utilizing the affected catalog entry. This vulnerability poses a significant risk to environment integrity, as it facilitates remote code execution at the execution privilege level of the Hermes Agent service.

Impact

The vulnerability allows an attacker to achieve remote code execution on any system running affected versions of Hermes Agent. By compromising an upstream dependency, the attacker gains the ability to execute arbitrary commands across the entire estate that consumes the affected catalog. This could lead to full system compromise, exfiltration of sensitive configuration data, or lateral movement within the affected network.

Recommendation

• Upgrade all instances of Hermes Agent to version 0.19.0 or later immediately to resolve the dependency management issue.
• Audit all local MCP catalog configurations to identify and manually pin any mutable branch references to specific, verified commit SHAs until upgrades are complete.
• Implement egress filtering for systems running Hermes Agent to restrict connections only to trusted, known-good repository domains, limiting the attacker's ability to pull malicious payloads from rogue infrastructure.
• Monitor for unauthorized modifications to local MCP catalog files or unexpected network activity from the Hermes Agent process originating from package distribution sources.