A flaw in the execute_code function of the Environment Variable Handler permits attackers to inject crafted environment variables that break the hermes-agent sandbox, enabling arbitrary command execution. The flaw is classified as CWE-264 and CWE-265. An attacker can run arbitrary code within the hermes-agent process, potentially compromising confidentiality, integrity, and availability.

All releases of NousResearch hermes-agent up to and including version 2026.4.16 are vulnerable. No fixed build is currently available, and the vendor has not issued a public response.

The CVSS score of 6.9 marks the vulnerability as moderate, yet the description indicates an available public exploit, suggesting a realistic threat. EPSS data is missing, but the existence of an exploit increases the likelihood of real-world attacks. The attack vector is remote, via manipulation of environment variables that influence hermes-agent’s execution context. The lack of a KEV listing does not diminish its practical risk; administrators should treat it as a high-priority issue per the available evidence.