hermes-agent CVE-2026-10223

Authentication is required at a low-privilege level (CVSS PR:L confirmed from vector). The attack targets the _scan_memory_content function specifically, meaning the hermes-agent memory tool feature must be enabled and reachable - if this tool is disabled or the endpoint is not exposed, exploitation is blocked. No user interaction is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions or special environmental states are needed beyond having a valid low-privilege account. Exploitation is limited by the authentication prerequisite: unauthenticated attackers cannot directly trigger the vulnerability. The scope is unchanged (S:U), meaning the exploit does not inherently break out of the hermes-agent process boundary.

The CVSS 3.1 base score of 6.3 (Medium) reflects AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - network-reachable, low complexity, requiring only low-privileged authentication, with no user interaction needed. The temporal metrics sharpen the practical risk picture: E:P confirms a proof-of-concept exploit is publicly available, RL:X indicates no remediation level has been defined (consistent with vendor non-response), and RC:R signals reasonable but not fully confirmed confidence in the vulnerability details. No EPSS score or CISA KEV listing was provided in the input data; absence from KEV does not confirm non-exploitation, especially given the POC availability and the vendor's failure to engage. The low CIA impact triad (C:L/I:L/A:L) and unchanged scope limit worst-case blast radius per single exploitation, but the low attack complexity combined with a public exploit makes opportunistic targeting realistic. The primary risk amplifier here is the combination of no vendor patch and a public POC - defenders cannot rely on a fix timeline.

An attacker with a low-privileged account on a network-accessible hermes-agent instance crafts a malicious payload targeting the _scan_memory_content function in tools/memory_tool.py, injecting content that propagates to a downstream component such as an LLM prompt, subprocess call, or file operation. A public proof-of-concept exploit is available via GitHub gist, lowering the barrier to exploitation to script-level capability. Successful exploitation yields partial read/write access and may degrade availability of the agent service depending on the downstream injection sink.