Is there a public PoC exploit available for CVE-2026-10223?

Yes, a public proof-of-concept exploit is available for CVE-2026-10223. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-10223?

Yes, a patch is available for CVE-2026-10223. Update the affected software to the latest version immediately.

hermes-agent CVE-2026-10223

Q: What is the CVSS score of CVE-2026-10223?

CVE-2026-10223 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: Which versions of hermes-agent are affected by CVE-2026-10223?

Injection vulnerability in NousResearch hermes-agent's `_scan_memory_content` function exposes authenticated low-privileged remote users to partial confidentiality, integrity, and availability…. A patch is available.

EUVD-2026-33556 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-01 VulDB

GHSA-33qv-c5qm-799v

Code Injection Hermes Agent

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 06:22 vuln.today

Severity Changed

Jun 01, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jun 01, 2026 - 06:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. This affects the function _scan_memory_content of the file tools/memory_tool.py. This manipulation causes injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Injection vulnerability in NousResearch hermes-agent's _scan_memory_content function exposes authenticated low-privileged remote users to partial confidentiality, integrity, and availability compromise across all versions through 2026.4.30. The flaw originates in tools/memory_tool.py, where user-controlled input is insufficiently neutralized before being passed to downstream components. No public exploit identified at time of analysis is incorrect - a public proof-of-concept exploit exists (GitHub gist), and the vendor has not responded to responsible disclosure, meaning no patch has been released.

Technical ContextAI

CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) covers injection vulnerabilities where attacker-controlled data flows into a downstream interpreter or processor without adequate sanitization. The affected function _scan_memory_content in tools/memory_tool.py is a memory scanning routine in hermes-agent, an AI agent framework by NousResearch. Memory tool functions in agent frameworks typically process retrieved context or external data and may pass it to LLM prompts, command interpreters, or file system operations - any of which could serve as an injection sink. The CPE cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:* covers all versions of the hermes-agent application with no version floor, indicating the flaw is likely architectural rather than a regression. The injection class (CWE-74) does not disambiguate whether this is prompt injection, OS command injection, or another subtype; the VulDB report uses the generic 'injection' tag alongside 'Code Injection,' suggesting the downstream impact involves code or command execution rather than purely data manipulation.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor did not respond to disclosure, and no fixed version has been published. Until a patch is available, operators should restrict network access to the hermes-agent instance using firewall rules or VPN enforcement to limit exposure to the AV:N attack vector. Because PR:L is required, enforce strict account controls: disable or remove low-privilege accounts that do not require access to the memory tool feature, reducing the attacker surface. If the _scan_memory_content functionality in tools/memory_tool.py is not operationally required, disable or remove the memory tool module - this eliminates the vulnerable code path entirely but may reduce agent functionality. Monitor invocations of the memory tool for anomalous input patterns as a detective control. Track the VulDB entry (https://vuldb.com/vuln/367502) and the GitHub POC (https://gist.github.com/YLChen-007/a1fb77ad2488c545a35d0f66356ea7b4) for any patch availability updates.