CVE-2026-10220: NousResearch hermes-agent Injection Vulnerability – Patch Guidance

Technical summary

CVE-2026-10220 is a remote code injection vulnerability affecting NousResearch hermes-agent versions up to 2026.4.30. The flaw resides in the _serve_plugin_skill/skill_view endpoint within tools/skills_tool.py, where user-supplied input is not properly sanitized before being processed. This allows an attacker to inject malicious payloads that manipulate backend logic, execution flow, or data handling. The vulnerability is classified under CWE-707 (Improper Neutralization) and CWE-74 (Injection), indicating inadequate input validation controls. The CVSS v3.1 score of 7.3 (HIGH) reflects the network accessibility, low complexity of exploitation, and the potential for unauthorized access and data manipulation.

Business impact

Exploitation of this vulnerability could allow an unauthenticated remote attacker to compromise systems running vulnerable versions of hermes-agent. Depending on the injection vector and application context, an attacker may exfiltrate sensitive data, modify application behavior, or disrupt service availability. Organizations relying on hermes-agent for critical workflows face elevated risk of data breach, service interruption, or unauthorized system access. The public disclosure of this vulnerability significantly increases the likelihood of opportunistic exploitation.

Affected systems

NousResearch hermes-agent versions up to and including 2026.4.30 are vulnerable. Verify the exact affected product range and any patched versions by consulting the vendor advisory. Any deployment or integration of hermes-agent within this version window is potentially at risk.

Exploitability

This vulnerability has a high exploitability profile. It requires no authentication, can be triggered over the network without user interaction, and the attack complexity is low. Because exploit code or proof-of-concept details have been publicly disclosed, attackers have reduced barriers to weaponization. The attack surface is immediate and widespread for any internet-facing or network-accessible hermes-agent instance.

Remediation

Organizations should immediately identify all instances of NousResearch hermes-agent in their environment and determine their version. Upgrade to a patched version released by the vendor—consult the vendor's security advisory for the specific minimum version that resolves CVE-2026-10220. If upgrading is not immediately possible, consider disabling or isolating the hermes-agent service, restricting network access via firewall rules, or implementing Web Application Firewall (WAF) rules to block malicious skill_view requests.

Patch guidance

Check the official NousResearch hermes-agent repository or security advisories for the patched release version. Apply the patch during a scheduled maintenance window. Before patching, document the current version and any custom configurations. Test the patch in a non-production environment to verify compatibility with your existing integrations. After patching, validate that plugin skills and skill_view functionality operate as expected.

Detection guidance

Monitor network traffic for HTTP requests to the skill_view endpoint with unusual or suspicious parameters. Look for payloads containing script injection patterns, SQL metacharacters, or command shell syntax in request bodies or query strings. Enable detailed logging on hermes-agent instances to capture skill_view invocations and their arguments. Use intrusion detection systems (IDS) or endpoint detection and response (EDR) tools to flag exploitation attempts. Correlate skill_view errors or exceptions with suspicious network activity to identify compromise attempts.

Why prioritize this

This vulnerability merits high priority remediation due to its CVSS score of 7.3, public exploit disclosure, complete lack of authentication requirements, network accessibility, and the vendor's failure to respond to early disclosure attempts. The combination of ease of exploitation and potential impact on confidentiality, integrity, and availability makes this a near-term risk that demands swift action.

Risk score, explained

The CVSS v3.1 score of 7.3 (HIGH severity) is driven by: (1) Network Attack Vector (AV:N)—no physical or local access required; (2) Low Attack Complexity (AC:L)—exploitation requires minimal sophistication; (3) No Privileges Required (PR:N)—unauthenticated access; (4) No User Interaction (UI:N)—attack succeeds without victim involvement; (5) Unchanged Scope (S:U)—impact is limited to the vulnerable component; and (6) Low impact on Confidentiality, Integrity, and Availability (C:L/I:L/A:L)—data exposure, modification, or service disruption. This score reflects moderate severity with significant ease of exploitation.

Frequently asked questions