Which versions of Hermes Agent are affected by CVE-2026-10221?

Organizations using NousResearch Hermes Agent (through v0.12.0) face immediate risk from remote attackers who can inject malicious prompts without credentials, potentially achieving code execution in…

Is there a public PoC exploit available for CVE-2026-10221?

Yes, a public proof-of-concept exploit is available for CVE-2026-10221. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10221?

Within 24 hours: Inventory all systems running NousResearch Hermes Agent ≤v0.12.0 and immediately isolate from untrusted networks; document all exposed instances and dependent applications. Within 7 days: Implement strict input validation and prompt sanitization to reject injection patterns; deploy network segmentation restricting agent communication to trusted endpoints only. Within 30 days: Migrate to alternative agent frameworks without disclosed RCE vulnerabilities or discontinue Hermes Agent use entirely pending vendor remediation.

Hermes Agent CVE-2026-10221

Q: What is the CVSS score of CVE-2026-10221?

CVE-2026-10221 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33554 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-01 VulDB

GHSA-xq8w-9jvx-gm3v

Code Injection Hermes Agent Nousresearch

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 01, 2026 - 04:22 NVD

HIGH MEDIUM

CVSS changed

Jun 01, 2026 - 04:22 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 01, 2026 - 04:21 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

13 pypi packages depend on hermes-agent (13 direct, 1 indirect)

Ecosystem-wide dependent count for version 0.19.0.

DescriptionCVE.org

A vulnerability was identified in NousResearch hermes-agent up to 0.12.0. Affected by this vulnerability is the function _compress_context of the file run_agent.py. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote code/prompt injection in NousResearch Hermes Agent through 0.12.0 stems from improper neutralization in the _compress_context function within run_agent.py (CWE-74). Publicly available exploit code exists and the issue is remotely triggerable without authentication per the CVSS vector, though impact is bounded to Low across confidentiality, integrity, and availability. The vendor was contacted but did not respond, leaving downstream users without an official fix at time of analysis.

Technical ContextAI

Hermes Agent is an LLM-based autonomous agent framework from NousResearch; the affected logic resides in run_agent.py within _compress_context, a routine responsible for summarizing or compressing accumulated context (likely tool outputs, memory, or conversation history) before it is reinjected into the model loop. CWE-74 (Improper Neutralization of Special Elements - Injection) indicates that attacker-influenced data flows into a downstream interpreter (a prompt, shell, eval, or templating layer) without sufficient sanitization. In agent frameworks this class of bug typically enables prompt injection or command/code injection through poisoned context that the agent later acts upon. CPE coverage is cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*, indicating all versions up to and including 0.12.0 are in scope.

RemediationAI

No vendor-released patch identified at time of analysis; the vendor was reportedly contacted but did not respond. Operators should monitor the NousResearch Hermes Agent repository for a fixed release and, in the interim, audit and harden _compress_context in run_agent.py by strictly validating, escaping, or stripping control tokens, delimiters, and instruction-like substrings from any external content (tool outputs, retrieved documents, user messages) before it is concatenated into the compressed context that is fed back to the LLM or to any downstream interpreter. Compensating controls include restricting which tools and data sources the agent can ingest (disable web fetching or untrusted retrieval connectors - trade-off: reduced agent capability), running the agent under a least-privileged service account and sandbox so any code-execution side effect of injection is contained (trade-off: deployment complexity), and gating outbound actions behind human-in-the-loop confirmation (trade-off: throughput). Consult VulDB at https://vuldb.com/vuln/367500 and the PoC at https://gist.github.com/YLChen-007/d343fcfe2c009cd45f56dc475fd5ac03 to derive concrete sanitization rules.