CVE-2026-10222

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent versions prior to 2026.4.31

Description An injection flaw exists in the sanitize env lines() function within the hermes cli/config.py file. This issue allows for remote attacks, although exploitation is considered difficult and requires a high level of complexity.

Recommendations Update to a version later than 2026.4.30. As a temporary workaround, restrict access to the sanitize env lines() function in the hermes cli/config.py file to minimize the risk of exploitation.