Executive brief
NousResearch hermes-agent is an AI agent framework. A security vulnerability in its Matrix messaging adapter allows the agent to send messages containing malicious code or hidden links. If a user interacts with these messages through a Matrix chat client, it could lead to unauthorized actions or script execution within their chat application.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the MatrixAdapter._markdown_to_html function within gateway/platforms/matrix.py. The component uses the Python 'markdown' library to convert text to HTML for Matrix 'org.matrix.custom.html' payloads but fails to sanitize the resulting output. This allows raw HTML tags (e.g., <img> with onerror attributes) and dangerous URI schemes (e.g., javascript:, data:, vbscript:) to be included in the 'formatted_body' of outbound messages. While a safer fallback renderer exists, it is bypassed when the 'markdown' package is installed. An attacker with the ability to influence the agent's message content can execute this remotely, potentially leading to XSS in downstream Matrix clients. A patch has been proposed in pull request #42759 but is currently awaiting acceptance.
Affected products
- NousResearch hermes-agent <= 2026.5.29.2
Timeline
- 2026-06-09: disclosed: Issue reported on GitHub and fix proposed via PR #42759
- 2026-07-10: advisory: CVE-2026-15311 published via VulDB/NVD