Is there a public PoC exploit available for CVE-2026-10222?

Yes, a public proof-of-concept exploit is available for CVE-2026-10222. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-10222?

Yes, a patch is available for CVE-2026-10222. Update the affected software to the latest version immediately.

hermes-agent CVE-2026-10222

Q: What is the CVSS score of CVE-2026-10222?

CVE-2026-10222 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33555 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-01 VulDB

GHSA-mv8x-fg99-32mf

Code Injection Hermes Agent Nousresearch

2.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 06:22 vuln.today

Severity Changed

Jun 01, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 06:22 NVD

5.6 (MEDIUM) 2.9 (LOW)

DescriptionCVE.org

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.30. Affected by this issue is the function _sanitize_env_lines of the file hermes_cli/config.py. The manipulation results in injection. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Injection vulnerability in NousResearch hermes-agent (all versions through 2026.4.30) allows remote unauthenticated attackers to exploit improper neutralization in the _sanitize_env_lines function of hermes_cli/config.py, achieving partial confidentiality, integrity, and availability impact. The flaw is tagged as code injection (CWE-74), meaning attacker-controlled input passed through this sanitization routine may reach a downstream component in an executable or interpreted context. A public proof-of-concept exploit exists (GitHub gist), though the CVSS vector assigns high attack complexity, indicating exploitation is not trivial. No vendor patch exists; the vendor was unresponsive to coordinated disclosure.

Technical ContextAI

CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) describes failures where user-controlled data is insufficiently escaped or filtered before being passed to an interpreter, shell, or other downstream consumer. Here, the vulnerable surface is the _sanitize_env_lines function in hermes_cli/config.py, which is responsible for processing environment variable line entries as part of the CLI configuration layer of the hermes-agent AI agent framework by NousResearch. The function name implies it was designed to clean environment-variable formatted input (e.g., KEY=VALUE pairs), but fails to neutralize special characters or sequences that a downstream component - such as a shell, subprocess spawner, or configuration parser - would interpret as control characters or injection payloads. The affected CPE is cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*, indicating all versions up to and including 2026.4.30. The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L confirms the attack can be executed remotely without authentication, but requires elevated exploitation complexity to succeed.

RemediationAI

No vendor-released patch identified at time of analysis. The CVSS remediation level is RL:X (Not Defined), and the vendor did not respond to coordinated disclosure, leaving users without an official fix. As a compensating control, operators should restrict network access to any interface or API endpoint that accepts input processed by the hermes_cli configuration layer - this directly limits AV:N exploitability. Specifically, if hermes-agent is deployed with a network-accessible configuration endpoint, that endpoint should be placed behind authentication or network-level ACLs (e.g., firewall rules limiting access to trusted IPs), accepting the trade-off of reduced operational flexibility. Where possible, treat all environment-line input as untrusted and pre-validate it against a strict allowlist of characters (e.g., only alphanumeric and underscore for KEY names, restricted value character sets) at the ingestion boundary before it reaches _sanitize_env_lines. Operators should monitor the VulDB entry https://vuldb.com/vuln/367501 and the GitHub gist at https://gist.github.com/YLChen-007/7ee2eeaa383b3540d2e8854250c03fb0 for any updated exploit variants that may reduce the AC:H complexity. Pinning to the last known-safe version is not currently possible given the open-ended CPE range.