CVE-2026-10220

HighCVSS 7.3/10Last modified Jul 22, 2026

Description

A vulnerability was determined in NousResearch hermes-agent up to 2026.4.30. Affected is the function _serve_plugin_skill/skill_view of the file tools/skills_tool.py. Executing a manipulation can lead to injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-707

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2026
Last modified
Jul 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1022017.8Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.CVE-2026-1022027.8Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges loCVE-2026-1022038.8Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.CVE-2026-1022047.8Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate priviCVE-2026-1022057.8Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges loCVE-2026-1022066.8Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attacCVE-2026-1022077.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker CVE-2026-1022087.0Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.CVE-2026-1022097.0Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.CVE-2026-102217.3A vulnerability was identified in NousResearch hermes-agent up to 0.12.0. Affected by this vulnerability is the function _compress_context oCVE-2026-1022109.8Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.CVE-2026-1022117.0Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
CVE-2026-10220: High severity, CVSS 7.3 | Vulnix