2026-10-24-hermes-agent-dependency-repairs-reach-stable-with-exploit-conditions-narrower-than-the-package-names

Dependency repairs reach stable, with exploit conditions narrower than the package names. The current pins are Pillow 13.0.0, certifi 2026.10.19, PyJWT 2.15.1 and MCP 2.3.0. Pillow, CVE-2026-112403 / GHSA-8g5g-8vmr-9782, published 2026-10-20: a crafted lossless JPEG can write attacker-controlled decoded bytes past a heap buffer when draft/thumbnail scaling is used with libjpeg-turbo 3. This corrupts process memory. Pillow <=12.3.0 is affected; 13.0.0 is the first patch. A Hermes decoding-path exploit was not established. Certifi / GHSA-6q48-6c7w-9gw2, published 2026-10-20: someone holding a compromised emSign intermediate key and able to intercept traffic can forge a certificate for a hostname and intercept or alter TLS traffic. Upgrade the trust bundle to 2026.10.19 or later. This is not Python code execution. PyJWT, CVE-2026-102268 / GHSA-ffc3-869f-jxw9, published 2026-09-29: an attacker knowing the public verification key can forge accepted HMAC tokens only when the verifier mixes HMAC and asymmetric algorithms and supplies a specially formatted raw PEM key. The inspected Hermes OIDC allowlist excludes HMAC, so this is not evidence of that Hermes auth bypass. PyJWT, CVE-2026-101918 / GHSA-42vr-xj54-vc7v, published 2026-09-30: a deeply nested unsigned payload can make pre-verification decoding throw an uncaught exception and fail the request. The maintainer’s confirmed impact is request-level failure, not a demonstrated worker/process crash, persistent exhaustion or auth bypass. Affected supported versions end at 2.14.0; the first fix is 2.15.0. MCP, CVE-2026-59951 / GHSA-84m7-p3x7-pcfv, published 2026-10-15: a reachable client can create unlimited retained stateful StreamableHTTP sessions and exhaust server memory. Fixes begin at 1.30.0 and 2.2.0. Stdio and SSE-only servers are outside that advisory; the official Hermes conversation bridge is stdio-only. The September PyJWT advisories are in-window dependency remediation, not new October disclosures.

Channel: tagged-release. Half: defect. Date: 2026-10-23.

Operator consequence: Upgrade the environment and verify installed dependency versions, including separately installed plugins. Do not equate each dependency advisory with a demonstrated Hermes exploit: the inspected OIDC path permits asymmetric algorithms only, the Hermes MCP bridge uses stdio, and the exact Pillow decoding path was not exercised. These pins reduce known dependency exposure; they do not settle the still-inaccessible Hermes-specific Git/filter or webhook advisory ranges.

Receipt

• https://github.com/NousResearch/hermes-agent/commit/27c61463814f27ada4c2d5625a8839ed51f01f41
• https://github.com/NousResearch/hermes-agent/commit/5aa2f1b56c58114fd9c9c8a3942049bf8690c5ac
• https://github.com/NousResearch/hermes-agent/commit/0346b3ba6a048df9df5e36bbfbc2c25869a744f6
• https://github.com/NousResearch/hermes-agent/commit/e27dee203527f61a0d88db1227b6ebbe07f8d5eb
• https://github.com/NousResearch/hermes-agent/blob/v0.22.5/pyproject.toml
• https://github.com/NousResearch/hermes-agent/blob/v0.22.5/uv.lock