The vulnerability CVE-2026-10220 affects the NousResearch hermes-agent product, specifically the _serve_plugin_skill/skill_view function in the tools/skills_tool.py file. It allows remote injection attacks that can be triggered without authentication or user interaction. The flaw is present in all versions up to and including 2026.4.30. The vendor was notified but has not provided any response or remediation. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform injection attacks against the hermes-agent service. This could lead to unauthorized manipulation of the affected function's behavior, potentially impacting the integrity and confidentiality of the system. However, the impact is rated medium due to the limited scope of the injection and low impact metrics in the CVSS vector. There are no known exploits in the wild at this time.

No official fix or patch is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor the vendor's channels for any future advisories or patches. Until a fix is released, consider implementing network-level protections such as restricting access to the hermes-agent service to trusted hosts only. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.