Skip to content
Threat Feed
Subscribe

Tag

Hermes-Agent

3 briefs RSS
high threat

NousResearch hermes-agent Remote Code Injection Vulnerability (CVE-2026-10220)

A remote code injection vulnerability (CVE-2026-10220) exists in NousResearch hermes-agent versions up to 2026.4.30, affecting the _serve_plugin_skill/skill_view function in tools/skills_tool.py, potentially allowing attackers to inject arbitrary code.

exploited hermes-agent cve code-injection
2r 1t 1c
high advisory

NousResearch hermes-agent Injection Vulnerability (CVE-2026-9366)

A remote injection vulnerability exists in NousResearch hermes-agent 2026.4.23 within the _scan_context_content function of the agent/prompt_builder.py file, allowing attackers to inject malicious code.

hermes-agent cve injection
2r 1t 1c
high advisory

NousResearch hermes-agent Missing Authorization Vulnerability (CVE-2026-9350)

A missing authorization vulnerability (CVE-2026-9350) exists in NousResearch hermes-agent up to version 2026.4.16, affecting the `check_all_command_guards` function in `tools/approval.py` of the Batch Runner component, enabling remote attackers to bypass authorization checks.

hermes-agent cve authorization
2r 1t 1c