Is CVE-2026-10220 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10220 being exploited in the wild.

How severe is CVE-2026-10220?

High severity, with a CVSS score of 7.3, published 1 June 2026.

Which products and versions are affected?

NousResearch hermes-agent up to 2026.4.30.

Is there a fix for CVE-2026-10220?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-10220 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10220?

Check whether you run NousResearch Hermes Agent. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10220: NousResearch hermes-agent prompt injection bypass in skills_tool.py

CVE-2026-10220 · Severity: high · CVSS 7.3 · Published 2026-06-01

NousResearch hermes-agent, a tool for managing AI agent skills and plugins, contains a security flaw in how it screens for malicious instructions. The system uses a basic text-matching filter that can be easily bypassed by slightly altering the wording of a command. If an attacker provides a malicious skill or plugin, they can override the AI's safety instructions, potentially gaining control over the agent's behavior or accessing sensitive information.

Technologies: NousResearch Hermes Agent. Vendors: NousResearch.

Quick answers

Is CVE-2026-10220 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10220 being exploited in the wild.
How severe is CVE-2026-10220?: High severity, with a CVSS score of 7.3, published 1 June 2026.
Which products and versions are affected?: NousResearch hermes-agent up to 2026.4.30.
Is there a fix for CVE-2026-10220?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10220 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10220?: Check whether you run NousResearch Hermes Agent. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A prompt injection vulnerability exists in the `_serve_plugin_skill` and `skill_view` functions within `tools/skills_tool.py`. The implementation relies on a static list of strings (`_INJECTION_PATTERNS`) and simple substring matching using Python's `in` operator to detect malicious content. Attackers can bypass this filter by using synonyms, inserting extra words, or adding whitespace (e.g., "ignore ALL prior instructions" instead of "ignore previous instructions"). While a more robust regex-based filter exists in `tools/skills_guard.py`, it is not utilized in the affected component. Successful exploitation allows an attacker-controlled skill to inject instructions directly into the LLM context, potentially leading to unauthorized data access or full agent takeover.

Affected products

NousResearch hermes-agent up to 2026.4.30

Timeline

2026-05-07: disclosed: Initial vulnerability report and PoC published on GitHub Gist.
2026-06-01: advisory: CVE-2026-10220 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.