Advisoriesby Ibishermes-agentGHSA-pgp4-xr4j-h5cg
hermes-agent has an Injection issue
Fix: upgrade to 0.15.0 or later
A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function _scan_context_content of the file agent/prompt_builder.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| hermes-agent PyPI | < 0.15.0 | 0.15.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-74
- Also known as
- CVE-2026-9366, PYSEC-2026-2514
More hermes-agent advisories
All hermes-agent
hermes-agent has an Uncontrolled Resource Consumption issueCVE-2026-10224no fix yethermes-agent has an Injection issueCVE-2026-10221no fix yethermes-agent has an Injection issueCVE-2026-10222fixed in 0.18.0hermes-agent has an Incorrect ComparisonCVE-2026-9369fixed in 0.15.0hermes-agent has a sandbox issueCVE-2026-9368fixed in 0.11.0hermes-agent has an Injection issueCVE-2026-9353fixed in 0.15.0