# CVE-2026-10220: NousResearch hermes-agent prompt injection bypass in skills_tool.py

Source: https://junglewise.ai/threats/cve-2026-10220-nousresearch-hermes-agent-prompt-injection-bypass-in-skills-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10220 · Severity: high · CVSS 7.3 · Published 2026-06-01

NousResearch hermes-agent, a tool for managing AI agent skills and plugins, contains a security flaw in how it screens for malicious instructions. The system uses a basic text-matching filter that can be easily bypassed by slightly altering the wording of a command. If an attacker provides a malicious skill or plugin, they can override the AI's safety instructions, potentially gaining control over the agent's behavior or accessing sensitive information.

Technologies: [NousResearch Hermes Agent](https://junglewise.ai/threats/technologies/hermes-agent). Vendors: [NousResearch](https://junglewise.ai/threats/vendors/nousresearch).

## Quick answers

**Is CVE-2026-10220 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10220 being exploited in the wild.

**How severe is CVE-2026-10220?** High severity, with a CVSS score of 7.3, published 1 June 2026.

**Which products and versions are affected?** NousResearch hermes-agent up to 2026.4.30.

**Is there a fix for CVE-2026-10220?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10220 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-10220?** Check whether you run NousResearch Hermes Agent. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A prompt injection vulnerability exists in the `_serve_plugin_skill` and `skill_view` functions within `tools/skills_tool.py`. The implementation relies on a static list of strings (`_INJECTION_PATTERNS`) and simple substring matching using Python's `in` operator to detect malicious content. Attackers can bypass this filter by using synonyms, inserting extra words, or adding whitespace (e.g., "ignore ALL prior instructions" instead of "ignore previous instructions"). While a more robust regex-based filter exists in `tools/skills_guard.py`, it is not utilized in the affected component. Successful exploitation allows an attacker-controlled skill to inject instructions directly into the LLM context, potentially leading to unauthorized data access or full agent takeover.

## Affected products

- NousResearch hermes-agent up to 2026.4.30

## Timeline

- 2026-05-07: disclosed: Initial vulnerability report and PoC published on GitHub Gist.
- 2026-06-01: advisory: CVE-2026-10220 published.

## References

- [https://gist.github.com/YLChen-007/9dd399c6f75b31fa741a613dfd41de08](https://gist.github.com/YLChen-007/9dd399c6f75b31fa741a613dfd41de08)
- [https://vuldb.com/cve/CVE-2026-10220](https://vuldb.com/cve/CVE-2026-10220)
- [https://vuldb.com/submit/822018](https://vuldb.com/submit/822018)
- [https://vuldb.com/vuln/367499](https://vuldb.com/vuln/367499)
- [https://vuldb.com/vuln/367499/cti](https://vuldb.com/vuln/367499/cti)

## Related threats

- [NousResearch hermes-agent resource exhaustion in resourceBufferFromUrl](https://junglewise.ai/threats/cve-2026-85107-nousresearch-hermes-agent-resource-exhaustion-in)
- [NousResearch hermes-agent server-side request forgery in Link Title Fetch](https://junglewise.ai/threats/cve-2026-85106-nousresearch-hermes-agent-server-side-request-forgery-in-link)
- [NousResearch hermes-agent authorization bypass in Session Management](https://junglewise.ai/threats/cve-2026-85105-nousresearch-hermes-agent-authorization-bypass-in-session)
- [NousResearch hermes-agent denial of service in MCP Tool](https://junglewise.ai/threats/cve-2026-84289-nousresearch-hermes-agent-denial-of-service-in-mcp-tool)
- [NousResearch hermes-agent denial of service in ACP Prompt Workflow](https://junglewise.ai/threats/cve-2026-84288-nousresearch-hermes-agent-denial-of-service-in-acp-prompt)