A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function _serve_plugin_skill/skill_view of the file tools/skills_to…

A remote injection vulnerability (CVE-2026-10220) was discovered in NousResearch hermes-agent up to version 2026.4.30. The vulnerability affects the _serve_plugin_skill/skill_view function in the tools/skills_tool.py file. The attack can be performed remotely through manipulation that leads to injection. The exploit has been publicly disclosed and is available for use. The vendor was contacted about the vulnerability but did not respond.