| عنوان | NousResearch hermes-agent <= v2026.4.30 Improper Input Validation (CWE-20) |
|---|
| الوصف | # Technical Details
A Prompt Injection Filter Bypass exists in the `_serve_plugin_skill` and `skill_view` methods in `tools/skills_tool.py` of hermes-agent.
The application fails to use robust regex matching for prompt injection detection, relying instead on naive exact-string substring matching via the `in` operator.
# Vulnerable Code
File: tools/skills_tool.py
Method: _serve_plugin_skill / skill_view
Why: `_INJECTION_PATTERNS` defines static literal strings, and the methods use `p in content.lower()` which only matches exact contiguous character sequences, failing to catch multi-word variants or synonym substitutions.
# Reproduction
1. Set up the hermes-agent environment: `export HERMES_ROOT=$(pwd)`
2. Download and execute the exploit PoC script (https://gist.github.com/YLChen-007/88d745b9bcd3d49d47427a0f7b2308e7) via `python3 poc_exploit.py`.
3. Observe that prompt payloads with extra words or synonym substitutions successfully bypass the filter and are injected into the agent's context.
# Impact
- Exfiltration of sensitive data (environment variables, API keys, file contents).
- Execution of arbitrary commands via the agent's shell tool, and override of safety constraints. |
|---|
| المصدر | ⚠️ https://gist.github.com/YLChen-007/9dd399c6f75b31fa741a613dfd41de08 |
|---|
| المستخدم | Eric-j (UID 98073) |
|---|
| ارسال | 07/05/2026 03:38 PM (28 أيام منذ) |
|---|
| الاعتدال | 31/05/2026 09:51 AM (24 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 367499 [NousResearch hermes-agent حتى 2026.4.30 tools/skills_tool.py _serve_plugin_skill/skill_view تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|