GitHub Advisoryadvisory · PyPI
GHSA-33qv-c5qm-799v hermes-agent has an Injection issue
LOW
Official page ↗
- Aliases
- CVE-2026-10223
- Ecosystem
- PyPI
- Packages
- hermes-agent
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-74
- Reviewed
- 2026-07-28
Affected packages
• PyPI hermes-agent: < 0.15.0 → fixed in 0.15.0
Description
A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. This affects the function _scan_memory_content of the file tools/memory_tool.py. This manipulation causes injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Related
Alias · CVE (1)
- CVE-2026-10223 A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. vulnerability
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-10223 advisory
- https://github.com/NousResearch/hermes-agent/commit/0dee92df22bdc0cfbcad90ca954aa14916f018de web
- https://gist.github.com/YLChen-007/a1fb77ad2488c545a35d0f66356ea7b4 web
- https://github.com/NousResearch/hermes-agent package
- https://vuldb.com/cve/CVE-2026-10223 web
- https://vuldb.com/submit/822021 web
- https://vuldb.com/vuln/367502 web
- https://vuldb.com/vuln/367502/cti web