CVE-2026-10223: NousResearch hermes-agent Injection Vulnerability – Exploit Available

Technical summary

CVE-2026-10223 is an injection vulnerability (CWE-707, CWE-74) in the _scan_memory_content function within tools/memory_tool.py of hermes-agent. The flaw allows authenticated users (CVSS vector PR:L) to inject arbitrary input that is processed without sufficient sanitization, leading to uncontrolled command or data manipulation. The vulnerability is remotely exploitable (AV:N) and requires no user interaction, making it straightforward to weaponize once access credentials are obtained. Public exploit availability significantly lowers the barrier to exploitation.

Business impact

Organizations deploying hermes-agent face the risk of data exfiltration, integrity compromise, and potential denial-of-service through an authenticated attack surface. The vulnerability could be leveraged by insider threats or attackers who compromise user credentials to manipulate agent memory, alter decision-making logic, or inject malicious directives into autonomous workflows. In production environments managing sensitive tasks, this poses material operational and compliance risk.

Affected systems

NousResearch hermes-agent versions up to and including 2026.4.30 are confirmed vulnerable. The vendor did not provide patched version information prior to public disclosure, so version status beyond 2026.4.30 should be verified against NousResearch's official advisory. Any deployment of the affected version range, particularly in environments where user authentication is implemented, requires immediate assessment.

Exploitability

This vulnerability has a practical exploitability advantage: public exploit code is available, authenticated access is required but often feasible in compromised or insider-threat scenarios, and no user interaction is needed for successful exploitation. The remote network attack vector (AV:N) combined with low attack complexity (AC:L) means exploitation can be automated and scaled. While the CVSS score of 6.3 (Medium) reflects the authentication requirement, the presence of public exploits and the injection primitive's versatility substantially increase real-world risk.

Remediation

Immediate action: Identify all instances of hermes-agent in your environment and verify the installed version against the affected range (≤2026.4.30). Contact NousResearch directly for patched version availability and upgrade guidance, as the vendor has not yet published a public advisory or patch information. In the interim, enforce strict access controls limiting hermes-agent credential distribution, monitor memory_tool.py invocations for suspicious input patterns, and isolate hermes-agent instances from critical data pipelines if immediate patching is not feasible.

Patch guidance

Check NousResearch's official channels (GitHub repository, security advisory page, or direct vendor communication) for a patched version superseding 2026.4.30. Upgrade as soon as a fix is confirmed and tested in a non-production environment. Given the vendor's lack of early response to disclosure, monitor for community-driven patches or forks if an official patch is significantly delayed. Test all upgrades thoroughly to ensure memory_tool.py functionality remains intact.

Detection guidance

Search logs for authentication events followed by invocations of tools/memory_tool.py, especially calls to _scan_memory_content with unusual or encoded input. Monitor process execution and file modifications initiated by hermes-agent processes. Implement input validation logging at the application level to capture injection attempts. Hunt for malformed or special-character-heavy arguments to memory scanning functions, and correlate suspicious patterns with credential compromise or lateral movement indicators.

Why prioritize this

Although the CVSS score is Medium (6.3), the combination of public exploit availability, authenticated but often-achievable credential compromise vectors, and the injection vulnerability's broad potential impact (confidentiality, integrity, availability) warrants prompt prioritization. Organizations with active hermes-agent deployments should address this within 30 days, particularly if the system interfaces with sensitive decision-making or data access.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects: remote network attack vector (AV:N), low attack complexity (AC:L), low authentication requirement (PR:L), no scope change (S:U), and limited but real impact to confidentiality, integrity, and availability (C:L, I:L, A:L). However, this score does not account for the public availability of exploit code or the likely prevalence of weak credential management in many organizations. Real-world risk should be assessed as elevated relative to the base score for any environment with distributed authentication.

Frequently asked questions