Vulnerability Reportnousresearch/hermes-agent:v2026.5.28

This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could exploit CVE-2019-1010023 to achieve code execution if the container runs ldd on malicious ELF files, or leverage CVE-2026-45445 to bypass encryption and forge authentication tags if the application uses the deprecated one-shot OpenSSL API. Many other high-severity issues, such as path traversal in Perl's Archive::Tar, further increase the attack surface. While the image is from a reputable source, the sheer number of vulnerabilities (1,064 exposed) makes it fundamentally unsafe without extensive remediation. Note that CVE-2026-45445 only applies when the application uses the EVP_Cipher() one-shot interface, which is discouraged and uncommon.