This vulnerability affects the NousResearch hermes-agent versions 0.1 through 0.12.0 in the _compress_context function of run_agent.py. It allows remote attackers to perform injection attacks due to improper input handling. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and partial impact on confidentiality, integrity, and availability. The vendor has not provided any advisory or patch, and no official remediation level is assigned.

Successful exploitation can lead to injection attacks that may partially compromise confidentiality, integrity, and availability of the affected system. The vulnerability can be triggered remotely without authentication or user interaction. However, the impact is limited as indicated by the CVSS vector. There are no known exploits in the wild beyond the publicly available proof-of-concept.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting network access to the hermes-agent service and applying any available application-level input validation or filtering as a temporary mitigation.