This vulnerability involves an injection flaw in the _serve_plugin_skill/skill_view function of the NousResearch hermes-agent up to version 2026.4.30. An attacker can remotely manipulate inputs to cause injection, potentially impacting the confidentiality, integrity, and availability of the affected system. The CVSS 4.0 base score is 6.9, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability. The vendor has not provided a patch or remediation, and the vulnerability is publicly disclosed.

Successful exploitation could allow an unauthenticated remote attacker to perform injection attacks against the hermes-agent, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The impact is rated as medium severity with a CVSS score of 6.9. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates and consider applying any available workarounds or mitigations if provided in the future. Until a patch is released, restricting network access to the affected service may reduce exposure.