This vulnerability involves injection via the THREAT_PATTERNS argument in an unknown function of agent/skills_guard.py in the Skills Guard Multi-Word Prompt Handler component of NousResearch hermes-agent versions up to 2026.4.23. The injection flaw allows an attacker to remotely exploit the system without privileges or user interaction. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. The vendor has not issued any fix or advisory despite early contact, and no patch links are available.

Successful exploitation of this injection vulnerability could allow an attacker to execute unauthorized commands or inject malicious input remotely, potentially compromising the affected component. The impact is rated medium, with low confidentiality, integrity, and availability impacts according to the CVSS vector. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes have been published, users should consider mitigating exposure by restricting network access to the affected component and monitoring for suspicious activity related to the THREAT_PATTERNS argument. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.