This vulnerability involves an injection flaw in the _compress_context function of the run_agent.py file within NousResearch's hermes-agent versions 0.1 through 0.12.0. The flaw allows remote attackers to manipulate input leading to injection, potentially impacting the confidentiality, integrity, and availability of the affected system. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. No official remediation or patch has been provided by the vendor, who has not responded to disclosure attempts. Exploit code is publicly available, but no known exploitation in the wild has been reported.

Successful exploitation could allow remote attackers to perform injection attacks against the hermes-agent, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The impact is rated as low for each security property, consistent with the CVSS vector. No confirmed active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying workarounds such as restricting network access to the hermes-agent service and monitoring for suspicious activity related to injection attempts. Follow updates from the vendor or trusted security sources for any forthcoming patches.