This vulnerability in NousResearch hermes-agent up to version 2026.4.23 involves injection via the THREAT_PATTERNS argument in an unspecified function within agent/skills_guard.py, part of the Skills Guard Multi-Word Prompt Handler. The injection flaw allows remote attackers to manipulate input leading to potential unauthorized actions or code execution. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. A public exploit exists, but the vendor has not provided any fix or mitigation guidance.

Successful exploitation can lead to injection attacks remotely without authentication or user interaction, potentially compromising confidentiality, integrity, and availability to a limited extent. The exact impact is not detailed, but injection vulnerabilities typically allow attackers to execute unauthorized commands or manipulate application behavior.

No official fix or patch is currently available, and the vendor has not responded to the vulnerability disclosure. Users should monitor for vendor advisories for any future updates. Until a patch is released, consider restricting network access to the affected component and applying any available compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.