CVE-2026-9366
A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function _scan_context_content of the file agent/prompt_builder.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 7.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.30%
- CWE
- CWE-74, CWE-707
- Published
- 2026-05-24
- Last modified
- 2026-05-27
Affected products
- NousResearch hermes-agent
Weakness type
Related vulnerabilities
- CVE-2026-87572 — Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had...
- CVE-2026-86675 — itsourcecode Sales and Inventory System us_edit.php sql injection
- CVE-2026-65669 — Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-86667 — aircheng-org iWebShop-5 member.php member_list sql injection
- CVE-2026-86518 — code-projects Student Crud Operation edit.php sql injection
- CVE-2026-86517 — itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection
- CVE-2026-86310 — itsourcecode Sales and Inventory System cust_edit1.php sql injection
- CVE-2026-86309 — itsourcecode Sales and Inventory System pro_searchfrm.php sql injection