5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9366

CVE-2026-9366: hermes-agent has an Injection issue

A vulnerability was found in NousResearch hermes-agent 2026.4.23. The impacted element is the function _scan_context_content of the file agent/prompt_builder.py. The manipulation results in injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9366

CVE-2026-9366:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hermes-agent	pip	< 0.15.0	0.15.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a series of prompt injection flaws stemming from insufficient and decentralized input sanitization. The agent was susceptible to malicious inputs from three primary sources: context files (AGENTS.md, etc.), persisted memory files (MEMORY.md), and the output of tools that access external content (e.g., web_extract).

Context File Injection: The _scan_context_content function in agent/prompt_builder.py used a limited, local set of regex patterns to scan files that are directly injected into the system prompt. These patterns were bypassable.
Memory Injection: Similarly, the MemoryStore.load_from_disk method in tools/memory_tool.py relied on a separate but also insufficient set of patterns to scan memory files loaded from disk.
Indirect Prompt Injection: The make_tool_result_message function in agent/tool_dispatch_helpers.py treated all tool outputs as trusted, passing them directly to the model. This allowed malicious content from external sources, like web pages, to be interpreted as instructions.

The patch addresses these issues comprehensively. It centralizes threat detection into a new tools/threat_patterns.py module with more robust and extensive patterns (including detection for C2-like behavior). It then refactors the vulnerable functions to use this centralized scanner. For indirect injection, it implements an architectural defense by wrapping outputs from untrusted tools in semantic delimiters, instructing the model to treat the content as data, not instructions.

Vulnerable functions

_scan_context_content

agent/prompt_builder.py

This function is explicitly mentioned in the vulnerability description. It is responsible for scanning context files for malicious content before they are injected into the system prompt. The original implementation used a limited set of regular expressions for detection, which was insufficient and could be bypassed, leading to prompt injection.

MemoryStore.load_from_disk

tools/memory_tool.py

This method loads persisted agent memory from disk, which is then incorporated into the system prompt. Before the patch, the scanning for malicious content within these memory files was based on a limited set of patterns, creating a prompt injection vulnerability if an attacker could write to the memory files (e.g., `MEMORY.md`).

make_tool_result_message

agent/tool_dispatch_helpers.py

This function constructs the message containing the result from a tool's execution. Previously, it passed raw tool output to the model. This was a vector for indirect prompt injection, as tools fetching external content (e.g., `web_extract`) could return malicious text that the model would interpret as instructions. The patch mitigates this by wrapping such content in `<untrusted_tool_result>` tags.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.