Hermes Agent EUVD-2026-33546

Exploitation requires network reachability to the Hermes Agent HTTP service exposing the _serve_plugin_skill or skill_view routes from tools/skills_tool.py, and the deployment must be running NousResearch Hermes Agent at or below version 2026.4.30. Per CVSS PR:N/UI:N, no authentication or user interaction is needed, so any default deployment of the affected version exposing these endpoints is reachable. Risk is limited by the fact that Hermes Agent is a specialized AI agent framework with a comparatively small install base, and operators who restrict the service to localhost or place it behind authenticated proxies remove the network attack vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates remote, low-complexity, unauthenticated exploitation, which when combined with publicly available exploit code and the vendor's silence creates elevated short-term risk. However, the impact metrics are uniformly Low (C:L/I:L/A:L) and the exploit maturity is only Proof-of-Concept (E:P) with Reasonable confidence (RC:R), suggesting the demonstrated injection may not yet achieve full system compromise. EPSS data was not provided, and the CVE is not listed in CISA KEV, so widespread opportunistic exploitation is not confirmed; the issue is best treated as a credible threat to any internet-exposed Hermes Agent instance pending independent validation of the gist exploit. The 'Information Disclosure' tag aligns with the C:L impact and hints that the practical payoff may lean toward data leakage rather than full RCE.

An attacker scans for internet-exposed Hermes Agent deployments and sends a crafted HTTP request to the skill_view endpoint, embedding injection payloads in plugin skill parameters processed by _serve_plugin_skill. Using the publicly available PoC gist as a template, the attacker triggers the injection to read sensitive data or influence downstream command execution, with no credentials or user interaction required.