Advisoriesby Ibishermes-agentGHSA-xq8w-9jvx-gm3v
hermes-agent has an Injection issue
No fix yet
A vulnerability was identified in NousResearch hermes-agent up to 0.12.0. Affected by this vulnerability is the function _compress_context of the file run_agent.py. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| hermes-agent PyPI | <= 0.19.0 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-74
- Also known as
- CVE-2026-10221, PYSEC-2026-3577
- nvd.nist.gov/vuln/detail/CVE-2026-10221
- github.com/NousResearch/hermes-agent/issues/26979
- github.com/NousResearch/hermes-agent/pull/69860
- github.com/NousResearch/hermes-agent/commit/2ca38e5df43411afe11aedfc34bfd71a2eecd4bb
- gist.github.com/YLChen-007/d343fcfe2c009cd45f56dc475fd5ac03
- github.com/NousResearch/hermes-agent
- vuldb.com/cve/CVE-2026-10221
- vuldb.com/submit/822019
- vuldb.com/vuln/367500
- vuldb.com/vuln/367500/cti
More hermes-agent advisories
All hermes-agent
hermes-agent has an Injection issueCVE-2026-10223fixed in 0.15.0hermes-agent has an Uncontrolled Resource Consumption issueCVE-2026-10224no fix yethermes-agent has an Injection issueCVE-2026-10222fixed in 0.18.0hermes-agent has an Incorrect ComparisonCVE-2026-9369fixed in 0.15.0hermes-agent has a sandbox issueCVE-2026-9368fixed in 0.11.0hermes-agent has an Injection issueCVE-2026-9366fixed in 0.15.0