Cross-Site Scripting in NousResearch Hermes-Agent

Executive Summary

CVE-2026-15311 is a cross-site scripting (XSS) vulnerability in the Hermes Agent's Matrix adapter, specifically in the function that converts Markdown to HTML for outbound Matrix messages.

The vulnerability arises because the Matrix adapter uses the Python markdown library to render Markdown into HTML without properly sanitizing the output. This allows attacker-controlled Markdown content to include raw HTML and dangerous URL schemes such as javascript:, data:, or vbscript:.

As a result, malicious payloads like <img src=x onerror="alert(1)"> or links with javascript: URLs can be injected into the formatted_body field of Matrix messages, which downstream clients may render and execute, leading to script injection risks.

The issue affects Hermes Agent versions up to and including 2026.5.29.2, and the exploit is publicly available.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to cross-site scripting attacks when malicious Markdown content is sent through the Hermes Agent's Matrix adapter.

If you use the affected Hermes Agent versions, attackers can inject malicious scripts or dangerous links into Matrix messages that may be executed by downstream clients that trust or insufficiently sanitize these messages.

Such script execution can lead to unauthorized actions, data theft, session hijacking, or other malicious activities within the context of the affected Matrix clients.

The attack can be executed remotely and requires only that the attacker send specially crafted Markdown content.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unsafe rendering of attacker-controlled Markdown to HTML in the Hermes Agent's Matrix adapter, which can lead to cross-site scripting (XSS) via malicious payloads in Matrix messages.

To detect this vulnerability on your system or network, you should monitor outbound Matrix messages for suspicious HTML content or dangerous URL schemes such as "javascript:", "data:", or "vbscript:" embedded in the formatted_body field.

Commands to help detect potential exploitation might include searching logs or message payloads for suspicious patterns. For example, using grep on log files or message dumps:

• grep -r -i -E 'javascript:|data:|vbscript:' /path/to/matrix/messages/logs
• grep -r -i '<img src=x onerror=' /path/to/matrix/messages/logs

Additionally, inspecting the formatted_body fields in Matrix messages for raw HTML tags or suspicious links can help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying available patches or updates that fix the vulnerability by sanitizing the Markdown to HTML conversion process.

If a patch is not yet accepted or available, consider using the fallback markdown renderer (_markdown_to_html_fallback) which sanitizes dangerous HTML and URL schemes, instead of the vulnerable markdown library.

Additionally, monitor and filter outbound Matrix messages to block or sanitize any suspicious HTML or dangerous URL schemes before they reach clients.

Implementing or enabling the new _MatrixHTMLSanitizer class, as described in the fix, will help strip dangerous tags and attributes, and prevent XSS attacks.

Until the fix is applied, restrict user privileges to limit the ability to send potentially malicious markdown content.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows cross-site scripting (XSS) attacks through unsafe Markdown rendering in outbound Matrix messages, which can lead to the injection of malicious scripts in downstream clients.

Such XSS vulnerabilities can potentially lead to unauthorized access or exposure of sensitive information if exploited, which may impact compliance with data protection regulations like GDPR or HIPAA that require safeguarding personal and sensitive data.

However, the provided information does not explicitly state the direct impact on compliance with these standards or regulations.

Useful 0 Not Useful 0