CVE-2026-10223

Vulnerability

The _scan_memory_content function in tools/memory_tool.py of NousResearch hermes-agent up to version 2026.4.30 uses a flawed regex pattern (ignore\s+(previous|all|above|prior)\s+instructions) that fails to detect prompt injection payloads containing intervening words between 'ignore' and the keyword. For example, "ignore my previous instructions" bypasses the scanner and is written to MEMORY.md. The same vulnerable pattern exists in tools/mcp_tool.py at line 312 [1]. A similar bug was previously patched in cronjob_tools.py but not propagated to these files [1].

Exploitation

An attacker with remote access to any external chat interface (such as API server, Discord, or Slack) that integrates with hermes-agent can send a crafted message containing an injection payload like "ignore ALL prior instructions" or "ignore the above instructions". The payload evades the regex scanner because the pattern requires the keyword to appear immediately after 'ignore'. Once written to MEMORY.md, the injected content is loaded into the agent's system prompt on every session start via load_from_disk(), permanently altering agent behavior across all future sessions [1].

Impact

Successful exploitation allows an attacker to inject arbitrary instructions into the agent's system prompt, effectively hijacking the agent's behavior. This can lead to unauthorized actions, data disclosure, or other malicious operations depending on the injected instructions. The compromise is persistent as the malicious memory entry resides on disk and is reloaded indefinitely [1].

Mitigation

As of the publication date, no patch has been released by the vendor, who did not respond to the initial disclosure [1]. Users should consider disabling the memory tool (if possible) or manually applying a fix similar to the one used in cronjob_tools.py (which uses (?:\w+\s+)* to match zero or more intervening words). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at this time.