Hermes Agent's bundled MCP catalog pinned a branch instead of a commit: if the upstream repo were hijacked, installing would run someone else's code

Who is affected

Two things must both be true for the risk to become real: you installed the n8n entry on an affected version, and at that moment the main branch of the upstream repository CyberSamuraiX/hermes-n8n-mcp held malicious code. No source says the upstream was ever compromised, and there is no record of exploitation. The flaw is not in CISA KEV.

How it works

Hermes Agent ships a catalog of MCP servers approved by Nous Research. MCP (Model Context Protocol) is a standard that lets AI call external tools. Each catalog entry is a manifest file that says where to download the code from and which install commands to run. When a user runs hermes mcp install <name>, Hermes clones the git repository named in the manifest, runs its bootstrap commands (for example, creating a Python virtual environment and installing packages), and then runs it as a local process.

The problem was that the n8n entry said ref: main. main is a branch, which works like a bookmark that can be moved: every time the upstream pushes a new commit, it points at new code. So Nous reviewed the code as it looked on one day, but users got whatever was on the branch when they installed, with no integrity check in between. This maps to CWE-494 (Download of Code Without Integrity Check).

Notably, PR #30870, which created the catalog, says git entries are cloned at a pinned ref and never float on main. Yet both its schema example and the n8n entry it shipped used ref: main.

The flawed approach (conceptual illustration, not the actual file):

source: <third-party git repository>
install:
  ref: main          # a branch; upstream can change what it points to at any time

The fixed approach:

source: <third-party git repository>
install:
  ref: <full 40-character commit SHA>   # always one reviewed snapshot; cannot be moved

The fix (commit 9df5f87) also added an automated test that checks every shipped manifest: git installs must use full SHAs; package launchers such as uvx, npx, pipx, bunx and pnpx must use exact versions; HTTP-based entries are exempt. The docs also advise that a new pin should be at least two weeks old when chosen.

The risk arises at install or reinstall time. The CVE description and the VulnCheck advisory say that once the upstream repository is taken over, malicious code reaches every host that installs the affected catalog entry, with no further action by the operator. Hermes’s docs and PR #30870 say catalog entries are “never auto-updated” and must be reinstalled to refresh. Both are true at once: an install fetches the latest upstream code, while a copy that is already installed does not change on its own. So the exposure is any install or reinstall while the upstream is compromised. The “user interaction required” part of the CVSS vectors fits this.

Timeline

The date the flaw was reported to Nous Research is unknown. Credit goes to Zubair Ashraf of Helmet Security.

Further reading

• Scoring: The only scores come from the CNA, VulnCheck: CVSS 4.0 9.0 (Critical) and CVSS 3.1 8.3 (High). They are the same assessment under two scoring systems. NVD has not scored it; it lists VulnCheck’s scores as secondary and marks the entry Deferred. The score is high because the outcome would be full code execution on the host; “high attack complexity” reflects that an attacker would first need to take over the upstream repository. CISA’s SSVC data in the CVE record: exploitation “none”, not automatable, technical impact “total”.
• No vendor advisory: Nous Research’s GitHub security-advisories page lists nothing for this. The fix sits inside PR #64463, titled as adding Blender to the MCP catalog, and the v0.19.0 release notes describe it only as the Blender addition, not as a security fix.
• Version wording: The CVE description says “0.18.2 prior to 0.19.0” and the structured data says “lessThan 0.19.0”. They agree: 0.19.0 is fixed.
• This is not a breach: No source links this CVE to any campaign or worm, and no source says CyberSamuraiX/hermes-n8n-mcp was ever compromised.
• The broader lesson: An AI agent’s approved plug-in list is a software distribution channel. Pinning to immutable SHAs, enforcing that with an automated test, and using a cooldown period are standard supply-chain protections.