# CVE-2026-9366: NousResearch hermes-agent prompt injection in prompt_builder.py

Source: https://junglewise.ai/threats/cve-2026-9366-nousresearch-hermes-agent-prompt-injection-in-prompt-builder-py  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-24. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-9366 · Severity: high · CVSS 7.3 · Published 2026-05-24

NousResearch hermes-agent is an AI-powered agent that automatically loads project context files to guide its behavior. A vulnerability in how it scans these files allows an attacker to bypass security filters by using specific phrasing in files like AGENTS.md or .cursorrules. If a user runs the agent in a directory containing a malicious file, the attacker can take full control of the AI's instructions, potentially forcing it to execute unauthorized terminal commands, modify files, or steal data without any user interaction.

Technologies: [NousResearch Hermes Agent](https://junglewise.ai/threats/technologies/hermes-agent), [hermes-agent (PyPI)](https://junglewise.ai/threats/technologies/pypi-hermes-agent). Vendors: [NousResearch](https://junglewise.ai/threats/vendors/nousresearch), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-9366 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9366 being exploited in the wild.

**How severe is CVE-2026-9366?** High severity, with a CVSS score of 7.3, published 24 May 2026.

**Which products and versions are affected?** NousResearch Hermes Agent 2026.4.23; hermes-agent (PyPI) ECOSYSTEM:introduced=0,fixed=0.15.0.

**Is there a fix for CVE-2026-9366?** Yes. hermes-agent (PyPI): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9366 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9366?** Check whether you run NousResearch Hermes Agent or hermes-agent (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hermes-agent (PyPI): upgrade to 0.15.0 or later

  ```sh
  pip install "hermes-agent>=0.15.0"
  ```


## Technical details

A prompt injection vulnerability exists in the `_scan_context_content` function within `agent/prompt_builder.py`. The vulnerability is caused by an incomplete regular expression in the `_CONTEXT_THREAT_PATTERNS` list, specifically the pattern `ignore\s+(previous|all|above|prior)\s+instructions`. This regex fails to account for multi-word fillers (e.g., "ignore all prior instructions"), allowing malicious payloads to bypass the scanner. Because the agent automatically loads files such as `AGENTS.md`, `.cursorrules`, and `CLAUDE.md` from the current working directory, an attacker can achieve a zero-click full prompt override. This can be leveraged to force the LLM to use available tools like `terminal`, `write_file`, or `delegate_task`. The issue was addressed in version 0.15.0 by hardening the regex patterns.

## Affected products

- NousResearch hermes-agent < 0.15.0

## Identifiers

- CVE-2026-9366
- GHSA-pgp4-xr4j-h5cg
- PYSEC-2026-2514

## Timeline

- 2026-04-24: disclosed: Initial discovery and Gist publication
- 2026-05-24: advisory: NVD/VulDB disclosure
- 2026-05-26: advisory: GitHub Advisory published
- 2026-06-30: patched: GitHub Advisory reviewed and patch confirmed in 0.15.0

## References

- [https://gist.github.com/YLChen-007/581fd92de5548fbaacb2092e848a75cc](https://gist.github.com/YLChen-007/581fd92de5548fbaacb2092e848a75cc)
- [https://vuldb.com/submit/812227](https://vuldb.com/submit/812227)
- [https://vuldb.com/vuln/365329](https://vuldb.com/vuln/365329)
- [https://vuldb.com/vuln/365329/cti](https://vuldb.com/vuln/365329/cti)
- [https://github.com/NousResearch/hermes-agent/commit/0dee92df22bdc0cfbcad90ca954aa14916f018de](https://github.com/NousResearch/hermes-agent/commit/0dee92df22bdc0cfbcad90ca954aa14916f018de)

## Related threats

- [NousResearch hermes-agent resource exhaustion in resourceBufferFromUrl](https://junglewise.ai/threats/cve-2026-85107-nousresearch-hermes-agent-resource-exhaustion-in)
- [NousResearch hermes-agent server-side request forgery in Link Title Fetch](https://junglewise.ai/threats/cve-2026-85106-nousresearch-hermes-agent-server-side-request-forgery-in-link)
- [NousResearch hermes-agent authorization bypass in Session Management](https://junglewise.ai/threats/cve-2026-85105-nousresearch-hermes-agent-authorization-bypass-in-session)
- [NousResearch hermes-agent denial of service in MCP Tool](https://junglewise.ai/threats/cve-2026-84289-nousresearch-hermes-agent-denial-of-service-in-mcp-tool)
- [NousResearch hermes-agent denial of service in ACP Prompt Workflow](https://junglewise.ai/threats/cve-2026-84288-nousresearch-hermes-agent-denial-of-service-in-acp-prompt)