CVE-2026-10220 in hermes-agent
Summary
by MITRE • 06/01/2026
A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function _serve_plugin_skill/skill_view of the file tools/skills_tool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/01/2026
The vulnerability identified in NousResearch hermes-agent version 2026.4.30 represents a critical security flaw within the plugin skill serving functionality that could enable remote code execution through injection attacks. This issue resides in the _serve_plugin_skill/skill_view function located within the tools/skills_tool.py file, making it a direct target for exploitation. The vulnerability's exposure through the skill_view endpoint suggests that the application fails to properly sanitize or validate input parameters before processing them within the plugin serving mechanism. The attack vector is particularly concerning as it allows for remote exploitation without requiring local system access, meaning malicious actors could leverage this flaw from external networks to compromise affected systems.
The technical nature of this vulnerability aligns with common injection attack patterns that fall under CWE-74, which describes improper neutralization of special elements in output used by a downstream component. This weakness specifically manifests when the application does not adequately validate or sanitize user-supplied data before incorporating it into plugin execution contexts. The function's role in serving plugin skills indicates that it likely processes external inputs to determine which skills to execute or how to present them to users, creating a potential pathway for attackers to inject malicious code or commands. The fact that this vulnerability has been publicly disclosed and is considered exploitable means that threat actors have likely developed working attack vectors against affected systems.
The operational impact of this vulnerability extends beyond simple data compromise, as successful exploitation could lead to complete system compromise and unauthorized access to sensitive information. Attackers could potentially execute arbitrary code within the context of the hermes-agent application, allowing them to install malware, establish persistence mechanisms, or exfiltrate data from affected systems. The lack of vendor response to early disclosure attempts is particularly troubling as it indicates potential delays in patch development or deployment that leave organizations exposed for extended periods. This vulnerability affects any system running the affected version of the hermes-agent software, making it a widespread concern for organizations that rely on this toolchain for their operations.
Organizations should immediately implement mitigations including disabling the vulnerable plugin skill serving functionality, implementing network-level restrictions to prevent unauthorized access to the affected endpoints, and monitoring for suspicious activities that might indicate exploitation attempts. The ATT&CK framework categorizes this type of vulnerability under T1059 for command and scripting interpreter and T1203 for Exploitation for Client Execution, indicating that exploitation could lead to further lateral movement within compromised networks. Security teams should also consider implementing web application firewalls to filter malicious payloads targeting this specific function and ensure that all systems are updated to the latest patched versions as soon as they become available. The vulnerability's disclosure status suggests that defensive measures should be prioritized immediately to protect against potential active exploitation attempts in the wild.