Is CVE-2026-9366 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9366 being exploited in the wild.

How severe is CVE-2026-9366?

High severity, with a CVSS score of 7.3, published 24 May 2026.

Which products and versions are affected?

NousResearch Hermes Agent 2026.4.23; hermes-agent (PyPI) ECOSYSTEM:introduced=0,fixed=0.15.0.

Is there a fix for CVE-2026-9366?

Yes. hermes-agent (PyPI): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9366 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9366?

Check whether you run NousResearch Hermes Agent or hermes-agent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9366: NousResearch hermes-agent prompt injection in prompt_builder.py

CVE-2026-9366 · Severity: high · CVSS 7.3 · Published 2026-05-24

NousResearch hermes-agent is an AI-powered agent that automatically loads project context files to guide its behavior. A vulnerability in how it scans these files allows an attacker to bypass security filters by using specific phrasing in files like AGENTS.md or .cursorrules. If a user runs the agent in a directory containing a malicious file, the attacker can take full control of the AI's instructions, potentially forcing it to execute unauthorized terminal commands, modify files, or steal data without any user interaction.

Technologies: NousResearch Hermes Agent, hermes-agent (PyPI). Vendors: NousResearch, PyPI.

Quick answers

Is CVE-2026-9366 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9366 being exploited in the wild.
How severe is CVE-2026-9366?: High severity, with a CVSS score of 7.3, published 24 May 2026.
Which products and versions are affected?: NousResearch Hermes Agent 2026.4.23; hermes-agent (PyPI) ECOSYSTEM:introduced=0,fixed=0.15.0.
Is there a fix for CVE-2026-9366?: Yes. hermes-agent (PyPI): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9366 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9366?: Check whether you run NousResearch Hermes Agent or hermes-agent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

hermes-agent (PyPI): upgrade to 0.15.0 or later
```
pip install "hermes-agent>=0.15.0"
```

Technical details

A prompt injection vulnerability exists in the `_scan_context_content` function within `agent/prompt_builder.py`. The vulnerability is caused by an incomplete regular expression in the `_CONTEXT_THREAT_PATTERNS` list, specifically the pattern `ignore\s+(previous|all|above|prior)\s+instructions`. This regex fails to account for multi-word fillers (e.g., "ignore all prior instructions"), allowing malicious payloads to bypass the scanner. Because the agent automatically loads files such as `AGENTS.md`, `.cursorrules`, and `CLAUDE.md` from the current working directory, an attacker can achieve a zero-click full prompt override. This can be leveraged to force the LLM to use available tools like `terminal`, `write_file`, or `delegate_task`. The issue was addressed in version 0.15.0 by hardening the regex patterns.

Affected products

NousResearch hermes-agent < 0.15.0

Identifiers

CVE-2026-9366
GHSA-pgp4-xr4j-h5cg
PYSEC-2026-2514

Timeline

2026-04-24: disclosed: Initial discovery and Gist publication
2026-05-24: advisory: NVD/VulDB disclosure
2026-05-26: advisory: GitHub Advisory published
2026-06-30: patched: GitHub Advisory reviewed and patch confirmed in 0.15.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.