Which versions of hermes-agent are affected by CVE-2026-9353?

NousResearch hermes-agent versions through 2026.4.23 contain an unauthenticated remote injection vulnerability in the Skills Guard component that allows attackers to inject malicious payloads without…. A patch is available.

Is there a public PoC exploit available for CVE-2026-9353?

Yes, a public proof-of-concept exploit is available for CVE-2026-9353. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9353?

Within 24 hours: Inventory all deployments of hermes-agent and identify versions up to 2026.4.23; isolate affected instances from production environments if possible and document their criticality. Within 7 days: Implement network segmentation to restrict unauthenticated access to hermes-agent instances; deploy web application firewall rules to block suspicious multi-word prompt patterns; contact NousResearch for patch timeline and interim guidance. Within 30 days: Evaluate alternative agents without this vulnerability; develop migration plan if hermes-agent remains critical; establish monitoring for exploitation attempts targeting CVE-2026-9353.

hermes-agent CVE-2026-9353

Q: What is the CVSS score of CVE-2026-9353?

CVE-2026-9353 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31567 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-24 VulDB

GHSA-238w-f66p-w349

Information Disclosure Hermes Agent

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 26, 2026 - 19:52 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 19:52 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 24, 2026 - 05:15 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.23. Impacted is an unknown function of the file agent/skills_guard.py of the component Skills Guard Multi-Word Prompt Handler. The manipulation of the argument THREAT_PATTERNS leads to injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote injection vulnerability in NousResearch hermes-agent versions up to 2026.4.23 enables unauthenticated attackers to inject malicious payloads through the Skills Guard component's multi-word prompt handling mechanism. The vulnerability has publicly available exploit code and allows attackers to achieve limited confidentiality, integrity, and availability impacts without user interaction. Despite early vendor notification, no response or patch has been provided.

Technical ContextAI

The vulnerability affects the NousResearch hermes-agent, specifically in the Skills Guard component's multi-word prompt handler located in agent/skills_guard.py. The root cause is improper neutralization of special elements in user input (CWE-74), where the THREAT_PATTERNS argument can be manipulated to inject malicious content. Based on the CPE string, all versions of hermes-agent are potentially affected, though the description specifically mentions versions up to 2026.4.23.

RemediationAI

No vendor-released patch identified at time of analysis due to vendor non-responsiveness. As primary mitigation, organizations should consider disabling or restricting access to the Skills Guard functionality if business operations permit. Implement input validation and sanitization for any data passed to the THREAT_PATTERNS parameter in skills_guard.py. Monitor for exploitation attempts by logging and alerting on unusual patterns in Skills Guard prompt processing. Consider deploying web application firewall rules to filter potentially malicious multi-word prompts. Organizations heavily dependent on this functionality should evaluate alternative solutions or engage directly with NousResearch for private patch availability.