CVE-2026-10221

HighCVSS 7.3/10Last modified Jul 22, 2026

Description

A vulnerability was identified in NousResearch hermes-agent up to 0.12.0. Affected by this vulnerability is the function _compress_context of the file run_agent.py. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-707

Affected software

No affected versions have been published.

Timeline

Published
Jun 1, 2026
Last modified
Jul 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1022109.8Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.CVE-2026-1022117.0Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.CVE-2026-1022148.8Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.CVE-2026-1022157.8Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges loCVE-2026-1022167.8Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privilCVE-2026-1022178.8Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.CVE-2026-1022187.8Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges loCVE-2026-102225.6A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.30. Affected by this issue is the function _sanitize_env_linesCVE-2026-1022207.8Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.CVE-2026-1022214.4No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-1022258.8Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.CVE-2026-1022268.8Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to
CVE-2026-10221: High severity, CVSS 7.3 | Vulnix