The vulnerability CVE-2026-9366 affects NousResearch hermes-agent version 2026.4.23. It arises from improper handling in the _scan_context_content function of agent/prompt_builder.py, leading to injection. The vulnerability is remotely exploitable without authentication or user interaction. Although the exploit is publicly available, no official remediation or patch has been released, and the vendor has not responded to disclosure attempts.

Successful exploitation of this injection vulnerability could allow remote attackers to inject malicious input, potentially leading to unauthorized actions or compromise of the affected system. The CVSS 4.0 base score of 6.9 reflects a medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should monitor official channels for updates. Until a fix is released, consider restricting network access to the affected service or applying other environment-specific mitigations to reduce exposure.