PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10223 NousResearch CVE debrief

A low-severity injection weakness exists in NousResearch hermes-agent up to version 2026.4.30, specifically within the _scan_memory_content function in tools/memory_tool.py. The vulnerability allows remote attackers to perform injection attacks. The exploit has been publicly disclosed, and the vendor was contacted but did not respond. The CVSS 4.0 vector indicates network attack vector with low complexity, requiring low privileges and no user interaction, with low impacts to confidentiality, integrity, and availability. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-707 (Improper Neutralization).

Vendor
NousResearch
Product
hermes-agent
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running NousResearch hermes-agent versions up to 2026.4.30, particularly those exposing the agent to network-accessible environments. Security teams monitoring for injection vulnerabilities in AI/ML tooling infrastructure. Defenders tracking publicly disclosed exploits with unresponsive vendors.

Technical summary

The _scan_memory_content function in tools/memory_tool.py of NousResearch hermes-agent (versions up to 2026.4.30) contains an injection weakness exploitable remotely. The vulnerability stems from improper neutralization of special elements (CWE-74/CWE-707), allowing attackers to inject malicious content through the memory scanning functionality. With a CVSS 4.0 score of 2.1, the vulnerability requires low privileges and no user interaction, but impact is limited to low confidentiality, integrity, and availability effects. The exploit has been publicly released, though vendor remediation has not been forthcoming.

Defensive priority

LOW

Recommended defensive actions

  • Review and sanitize all inputs to the _scan_memory_content function in tools/memory_tool.py
  • Implement proper input validation and neutralization for memory content scanning operations
  • Apply principle of least privilege for functions handling external or user-controllable data
  • Monitor for updates from NousResearch regarding hermes-agent patches
  • Consider restricting network access to hermes-agent deployments until patch availability is confirmed
  • Review referenced technical details for specific injection vectors and implement corresponding mitigations

Evidence notes

Vulnerability identified in NousResearch hermes-agent _scan_memory_content function. CVSS 4.0 score of 2.1 (LOW severity). Public exploit available via referenced gist. Vendor non-responsive to disclosure attempts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10223 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10223

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10223 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10223

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.