CVE-2026-9366 Details

A prompt injection vulnerability has been identified in NousResearch Hermes-Agent version 2026.4.23. The issue arises in the context-file injection scanner within the function '_scan_context_content' of 'agent/prompt_builder.py'. This vulnerability allows for the injection of malicious instructions that are executed by the language model (LLM) via the agent's toolset, including commands that could be used for remote code execution. The flaw exists because the regex pattern used to scan context files fails to account for multi-word variations of certain phrases, allowing injected content to bypass the scanner's safeguards. The vulnerability can be exploited by placing a poisoned context file in a directory that the Hermes-Agent will read from when it is executed.

Users can manually edit the context files that Hermes-Agent loads to remove any malicious instructions. However, no official patch is available for this vulnerability at the moment.