This vulnerability in NousResearch hermes-agent versions up to 2026.4.30 is caused by an injection flaw in the _scan_memory_content function within tools/memory_tool.py. The flaw allows remote attackers to inject malicious input, potentially impacting the integrity and availability of the affected system. The vulnerability requires low attack complexity and no privileges or user interaction, but the impact on confidentiality, integrity, and availability is limited. No official remediation or patch has been provided by the vendor, and the exploit code is publicly available.

The injection vulnerability can be triggered remotely and may allow attackers to manipulate the affected function, potentially leading to partial compromise of system integrity and availability. The CVSS score of 5.3 reflects a medium severity with limited impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported beyond the public exploit availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider applying network-level controls to restrict access to the hermes-agent service and implement intrusion detection rules to detect exploitation attempts targeting the injection vulnerability.