Which versions of hermes-agent are affected by CVE-2026-9366?

NousResearch hermes-agent versions up to 2026.4.23 contain an unauthenticated remote code execution vulnerability in the context scanning function that allows attackers to execute arbitrary code on…. A patch is available.

Is there a public PoC exploit available for CVE-2026-9366?

Yes, a public proof-of-concept exploit is available for CVE-2026-9366. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9366?

Within 24 hours: Identify all systems running NousResearch hermes-agent up to version 2026.4.23 and isolate affected instances from untrusted networks. Within 7 days: Engage NousResearch for patch timeline confirmation; if no vendor patch is forthcoming, evaluate alternative agent libraries or implement network segmentation to restrict access to hermes-agent endpoints to trusted sources only. Within 30 days: Execute migration to a patched version once available, or complete transition to a vendor-supported alternative if NousResearch does not release a fix.

hermes-agent CVE-2026-9366

Q: What is the CVSS score of CVE-2026-9366?

CVE-2026-9366 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31580 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-05-24 VulDB

GHSA-pgp4-xr4j-h5cg

Code Injection Hermes Agent

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 26, 2026 - 19:52 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 19:52 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 24, 2026 - 09:30 vuln.today

DescriptionCVE.org

A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function _scan_context_content of the file agent/prompt_builder.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Code injection in NousResearch hermes-agent 2026.4.23 allows remote unauthenticated attackers to inject and execute arbitrary code through the _scan_context_content function in agent/prompt_builder.py. The vulnerability has publicly available exploit code and affects all versions up to 2026.4.23, with the vendor failing to respond to disclosure attempts.

Technical ContextAI

The vulnerability exists in the _scan_context_content function within the prompt_builder.py module of hermes-agent, a NousResearch product. The issue is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), indicating that user-controlled input is not properly sanitized before being used in a way that allows injection attacks. The CPE string indicates all versions of hermes-agent are affected.

RemediationAI

No vendor-released patch identified at time of analysis due to vendor non-response. Organizations should immediately review usage of the _scan_context_content function and implement input validation for any data passed to this function. Consider temporarily disabling or restricting access to functionality that uses prompt_builder.py until a patch is available. Monitor the VulDB references at https://vuldb.com/vuln/365329 for updates. As a compensating control, implement web application firewall rules to filter potentially malicious input patterns targeting this injection vulnerability, though this may impact legitimate functionality.