This vulnerability involves an injection flaw in the _sanitize_env_lines function of the hermes-agent software by NousResearch, affecting all versions up to 2026.4.30. The injection can be triggered remotely, but the attack complexity is high and exploitation is difficult. The vulnerability has a CVSS 4.0 base score of 6.3, indicating medium severity. No official patch or remediation has been disclosed by the vendor, and no cloud service is involved.

Successful exploitation could allow an attacker to perform injection attacks remotely against the hermes-agent, potentially leading to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. However, the high attack complexity and lack of privileges or user interaction required reduce the likelihood of exploitation. The public availability of an exploit increases risk, but the difficulty of exploitation limits immediate widespread impact.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should monitor vendor channels for updates. Given the high complexity of exploitation, immediate urgent remediation may not be required, but cautious exposure of the affected service to untrusted networks is advised until a fix is released.