Executive brief
NousResearch hermes-agent, a tool for managing AI agent configurations, contains a flaw in how it processes configuration files. An attacker could trick a user into using a specially crafted API key that contains hidden configuration commands. If successful, this allows the attacker to silently redirect the AI's traffic to a malicious server, potentially stealing sensitive prompts, responses, and legitimate credentials.
Technical details
A semantic injection vulnerability exists in the `_sanitize_env_lines` function within `hermes_cli/config.py` of NousResearch hermes-agent. The parser uses a naive `str.find()` method to split concatenated environment variables without verifying word boundaries. An attacker can craft a malicious credential (e.g., an API key) that embeds a known configuration key like `OPENAI_BASE_URL`. When the agent saves or loads this configuration, the parser incorrectly splits the line, treating the embedded string as a legitimate configuration override. This allows for persistent redirection of API traffic to attacker-controlled infrastructure. The issue is fixed in version 0.18.0.
Affected products
- NousResearch hermes-agent < 0.18.0
Timeline
- 2026-05-07: disclosed: Initial PoC and issue report created by researcher.
- 2026-06-01: advisory: CVE-2026-10222 published.
- 2026-07-09: patched: GitHub Advisory reviewed and patch version 0.18.0 confirmed.