This vulnerability involves an injection flaw in the _scan_context_content function of the hermes-agent software by NousResearch, specifically in version 2026.4.23. The injection can be triggered remotely without authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The vulnerability has a CVSS 4.0 base score of 6.9, reflecting medium severity with low complexity and no privileges required. The vendor has not issued any advisory or patch, and the exploit has been made public, increasing the risk of exploitation.

Successful exploitation could allow an unauthenticated remote attacker to inject malicious input into the hermes-agent process, potentially leading to unauthorized actions or data manipulation within the affected function. The exact impact beyond injection is not detailed in the available data. No known exploits in the wild have been reported yet, but public availability of exploit code increases the risk.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or provided guidance, users should consider restricting network access to the affected hermes-agent instance to trusted sources only and monitor for suspicious activity related to injection attempts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.