Executive Summary

CVE-2026-10222 is a high-severity configuration injection vulnerability in the Hermes agent's .env file parser, specifically in the _sanitize_env_lines() function within hermes_cli/config.py.

The flaw allows an attacker to inject arbitrary environment variables by embedding a known key name (e.g., OPENAI_BASE_URL=) inside a credential value (e.g., an API key). When a victim saves the crafted credential via normal CLI operations, the parser splits the line at the embedded key, creating a separate malicious environment variable in the .env file.

This injection persists across restarts because the split lines are written to disk during credential saves and removal operations. The root cause is the parser's use of naive substring matching (str.find()) without boundary checks, allowing key names to be matched anywhere in a line, including within values.

Useful 0 Not Useful 0

Impact Analysis

An attacker can hijack large language model (LLM) API calls by redirecting them to a proxy server, enabling full interception of prompts, responses, and credentials.

The attack requires no special privileges and can be triggered through social engineering, compromised OAuth tokens, or malicious integrations.

Because the injected environment variables persist across restarts, the attacker can maintain long-term control over the environment, potentially leading to data leakage, unauthorized access, and manipulation of sensitive operations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the .env files used by the hermes-agent for suspicious environment variable injections. Specifically, look for lines where known key names such as 'OPENAI_BASE_URL=' appear embedded within credential values, which indicates manipulation.

Since the vulnerability involves the _sanitize_env_lines() function improperly parsing environment variables, you can search for suspicious entries in the .env file that contain unexpected or duplicated keys.

• Use grep or similar commands to find suspicious environment variable injections, for example: grep -E 'OPENAI_BASE_URL=' path/to/.env
• Check for multiple occurrences or malformed lines in the .env file that could indicate injection: grep -n 'OPENAI_BASE_URL=' path/to/.env
• Monitor network traffic for unusual proxy connections or API calls redirected to unknown servers, as the exploit can hijack LLM API calls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include carefully auditing and sanitizing the .env files used by the hermes-agent to remove any injected or suspicious environment variables.

Since no patched versions are currently available, avoid saving credentials or environment variables that may contain embedded key names or suspicious substrings.

Restrict access to the hermes-agent configuration files and monitor for unauthorized changes.

Educate users to avoid social engineering attacks that could lead to malicious credential injection.

Monitor network traffic for unusual API call redirections or proxy usage that could indicate exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to inject arbitrary environment variables into the Hermes agent's configuration, enabling interception of API calls, including prompts, responses, and credentials.

Such interception and potential exposure of sensitive data could lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Therefore, exploitation of this vulnerability may compromise compliance with these standards by exposing confidential data and failing to maintain adequate security controls.

Useful 0 Not Useful 0