PatchSiren cyber security CVE debrief
CVE-2026-10220 NousResearch CVE debrief
A medium-severity injection vulnerability in NousResearch hermes-agent, affecting versions up to 2026.4.30. The flaw resides in the _serve_plugin_skill/skill_view function within tools/skills_tool.py. Remote attackers can exploit this issue to perform injection attacks. The exploit has been publicly disclosed, and the vendor was contacted but did not respond.
- Vendor
- NousResearch
- Product
- hermes-agent
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-01
- Original CVE updated
- 2026-06-01
- Advisory published
- 2026-06-01
- Advisory updated
- 2026-06-01
Who should care
Organizations running NousResearch hermes-agent instances, particularly those exposing skill/plugin functionality to remote or untrusted users. Security teams should prioritize review given public exploit availability and vendor non-response.
Technical summary
The vulnerability exists in the _serve_plugin_skill/skill_view function of tools/skills_tool.py in NousResearch hermes-agent through version 2026.4.30. Insufficient neutralization of special elements allows remote attackers to inject malicious input, leading to injection-based compromise. The attack vector is network-accessible with low attack complexity.
Defensive priority
medium
Recommended defensive actions
- Review and restrict network access to hermes-agent instances where possible.
- Inspect tools/skills_tool.py for the _serve_plugin_skill and skill_view functions; apply input validation and output encoding to mitigate injection risks.
- Monitor for unauthorized or unexpected plugin skill execution in hermes-agent deployments.
- Apply updates from NousResearch if and when a patched version is released.
- Review the publicly disclosed technical details to assess exposure and implement targeted mitigations.
Evidence notes
Vuldb-assigned CVE with CVSS 4.0 vector. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-707 (Improper Neutralization) are cited as weakness types. The vendor field is marked low-confidence and needs review.
Official resources
Public disclosure occurred with vendor non-response. A public proof-of-concept is available.