EUVD-2026-31567
GHSA-238w-f66p-w349
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted prompt to Skills Guard
-
DeliveryInject payload via THREAT_PATTERNS
-
ExploitExecute injected content
-
ExecutionAccess/modify limited data
-
ImpactDisrupt agent operations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of hermes-agent. The vulnerability requires only that the Skills Guard component be accessible and processing multi-word prompts, which appears to be default functionality. No user interaction is needed, and the attack can be conducted entirely over the network. The primary limiting factor is that impacts are rated as Low rather than High, suggesting the injection provides constrained rather than complete system access. |
| Impact | The CVSS 3.1 score of 7.3 indicates high severity with network-based, low complexity, unauthenticated remote exploitation (AV:N/AC:L/PR:N/UI:N). The EPSS data is not provided, but the existence of public exploit code (E:P) significantly increases real-world risk. While not listed in CISA KEV, the combination of public POC availability, no authentication requirements, and vendor non-responsiveness makes this a priority for organizations using hermes-agent. The limited impact ratings (C:L/I:L/A:L) suggest the vulnerability doesn't provide full system compromise but still poses material risk for data disclosure and service disruption. |
| Exploit ScenarioDerived | An attacker sends specially crafted multi-word prompts to the hermes-agent Skills Guard component over the network. The malicious input manipulates the THREAT_PATTERNS argument to inject code or commands, which are then processed by the agent without proper sanitization. This results in unauthorized data access, modification of agent behavior, or partial service disruption. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 24, 2026
Remote injection vulnerability in NousResearch hermes-agent versions up to 2026.4.23 enables unauthenticated attackers to inject malicious payloads through the Skills Guard component's multi-word prompt handling mechanism. The vulnerability has publicly available exploit code and allows attackers to achieve limited confidentiality, integrity, and availability impacts without user interaction. Despite early vendor notification, no response or patch has been provided.
RemediationAI
No vendor-released patch identified at time of analysis due to vendor non-responsiveness. As primary mitigation, organizations should consider disabling or restricting access to the Skills Guard functionality if business operations permit. Implement input validation and sanitization for any data passed to the THREAT_PATTERNS parameter in skills_guard.py. Monitor for exploitation attempts by logging and alerting on unusual patterns in Skills Guard prompt processing. Consider deploying web application firewall rules to filter potentially malicious multi-word prompts. Organizations heavily dependent on this functionality should evaluate alternative solutions or engage directly with NousResearch for private patch availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects the NousResearch hermes-agent, specifically in the Skills Guard component's multi-word prompt handler located in agent/skills_guard.py. The root cause is improper neutralization of special elements in user input (CWE-74), where the THREAT_PATTERNS argument can be manipulated to inject malicious content. Based on the CPE string, all versions of hermes-agent are potentially affected, though the description specifically mentions versions up to 2026.4.23.
Know when Hermes Agent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.23. Impacted is an unknown function of the file agent/skills_guard.py of the component Skills Guard Multi-Word Prompt Handler. The manipulation of the argument THREAT_PATTERNS leads to injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
NousResearch hermes-agent versions through 2026.4.23 contain an unauthenticated remote injection vulnerability in the Skills Guard component that allows attackers to inject malicious payloads without user interaction, affecting confidentiality, integrity, and availability. Organizations deploying this agent face immediate risk of unauthorized data access and system compromise, with no vendor patch currently available to remediate the exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to hermes-agent endpoints (allowlist authenticated users/systems only); implement input validation/sanitization specifically targeting multi-word prompt injection patterns in the Skills Guard component; deploy intrusion detection signatures monitoring for CVE-2026-9353 exploitation attempts; consider disabling Skills Guard feature if operationally feasible; maintain enhanced logging and alerting on hermes-agent activity for breach detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in NousResearch hermes-agent Security Flaws
View all 5More in Hermes Agent
View allRemote code execution in NousResearch Hermes Agent 0.18.2-0.21.0 allows an unauthenticated attacker to execute arbitrary
Remote command injection in NousResearch hermes-agent allows unauthenticated attackers to execute arbitrary OS commands
Path traversal in NousResearch hermes-agent (all versions through 2026.5.16) exposes arbitrary server-side files via the
Remote sandbox escape in NousResearch hermes-agent versions up to 2026.4.16 allows unauthenticated attackers to manipula
Path traversal in NousResearch hermes-agent 0.8.0 exposes arbitrary server-side files to unauthenticated remote attacker
Remote code/prompt injection in NousResearch Hermes Agent through 0.12.0 stems from improper neutralization in the _comp
Remote injection in NousResearch Hermes Agent through version 2026.4.30 allows unauthenticated attackers to manipulate t
Code injection in NousResearch hermes-agent 2026.4.23 allows remote unauthenticated attackers to inject and execute arbi
Uncontrolled resource consumption in NousResearch hermes-agent (all versions through 2026.4.30) allows remote unauthenti
Exploit-DB