CVE-2026-10221: NousResearch hermes-agent Remote Code Injection Vulnerability

Technical summary

CVE-2026-10221 is a remote injection vulnerability in the _compress_context function of run_agent.py within NousResearch hermes-agent. The vulnerability stems from improper input handling that fails to sanitize user-supplied data before processing. Attackers can craft malicious payloads that execute arbitrary code on affected systems. The attack vector is network-based with low complexity and requires no privileges or user interaction, making it straightforward to exploit. The vulnerability impacts confidentiality, integrity, and availability of affected systems.

Business impact

Organizations deploying hermes-agent face direct risk of unauthorized code execution, potentially leading to data theft, system compromise, lateral movement, and service disruption. The availability of public exploits significantly shortens the window between disclosure and active attacks. Teams relying on this agent for automation or AI workflows should treat this as a critical operational security issue requiring immediate attention.

Affected systems

NousResearch hermes-agent versions up to and including 0.12.0 are vulnerable. Verify your installed version immediately. Deployment environments vary; any system running a vulnerable hermes-agent instance over network-accessible infrastructure is at risk.

Exploitability

Exploitation is straightforward due to network accessibility, lack of authentication requirements, and low attack complexity. Public exploit code is already circulating, removing technical barriers to attack. Threat actors can weaponize this vulnerability with minimal effort, and active exploitation should be anticipated.

Remediation

Upgrade hermes-agent to a version newer than 0.12.0 once patched versions are released by NousResearch. The vendor was notified early but has not responded; verify the vendor advisory for confirmed patch availability before proceeding. If no patch exists, implement network segmentation to restrict access to hermes-agent deployments and consider disabling the vulnerable functionality if business logic permits.

Patch guidance

Check NousResearch's official repository and security advisories for patched versions exceeding 0.12.0. Apply patches immediately upon availability. Prior to patching, implement temporary compensating controls: restrict network access to hermes-agent instances using firewall rules or network segmentation, limit deployment to isolated or air-gapped environments where possible, and monitor for suspicious context compression function calls. Document your patch timeline and track all systems requiring updates.

Detection guidance

Monitor for suspicious network requests to hermes-agent endpoints, especially those containing unusual or malformed parameters intended for the _compress_context function. Log and alert on unexpected code execution patterns within agent processes. Analyze inbound traffic for injection payloads targeting the vulnerable function. Endpoint detection and response (EDR) tools should flag abnormal process behavior stemming from hermes-agent instances. Check application logs for errors or exceptions in context compression operations that may indicate exploitation attempts.

Why prioritize this

This vulnerability warrants immediate prioritization due to its HIGH CVSS score (7.3), network-based attack vector, absence of authentication or user interaction requirements, and publicly available exploit code. The vendor's lack of response creates uncertainty around patch timelines, necessitating rapid internal remediation. Any exposure of hermes-agent to untrusted networks materially increases organizational risk.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects the combination of remote network accessibility, low attack complexity, no authentication requirement, no user interaction needed, and impact across all three security pillars: confidentiality, integrity, and availability. Public exploit availability elevates practical risk beyond the base score. Organizations should treat this as a high-priority vulnerability requiring action within days, not weeks.

Frequently asked questions