CVE-2026-15311: NousResearch hermes-agent XSS Vulnerability

CVE-2026-15311 Overview

CVE-2026-15311 is a cross-site scripting (XSS) vulnerability in the NousResearch hermes-agent project through version 2026.5.29.2. The flaw resides in the MatrixAdapter._markdown_to_html function within gateway/platforms/matrix.py, part of the Matrix Adapter component. Improper handling of Markdown-to-HTML conversion allows an authenticated remote attacker to inject script content that executes in the context of a victim's client. A public exploit exists, and a fix is pending merge upstream. The issue is tracked under [CWE-79] and affects deployments that expose the Matrix Adapter to untrusted message input.

Critical Impact
Authenticated attackers can inject arbitrary script into rendered Matrix messages, enabling session-context script execution against users interacting with the hermes-agent gateway.

Affected Products

NousResearch hermes-agent versions up to and including 2026.5.29.2
Deployments using the Matrix Adapter component (gateway/platforms/matrix.py)
Instances relying on MatrixAdapter._markdown_to_html for message rendering

Discovery Timeline

2026-07-10 - CVE-2026-15311 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-15311

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw [CWE-79] in the Matrix Adapter of the hermes-agent gateway. The MatrixAdapter._markdown_to_html function converts Markdown input into HTML for delivery to Matrix clients. The conversion routine does not adequately sanitize or escape attacker-controlled content before emitting HTML. As a result, crafted Markdown payloads containing embedded HTML or script constructs pass through unencoded and are rendered by downstream clients.

Exploitation requires network access to the gateway and low-privilege authentication, and it depends on a victim viewing the resulting message. A public proof of concept is referenced by VulDB, increasing the likelihood of opportunistic use against exposed instances.

Root Cause

The root cause is insufficient output encoding in _markdown_to_html. The function trusts Markdown input and produces HTML that preserves attacker-supplied tags or attributes. Without a sanitizer such as an allow-list HTML filter applied to the converted output, script-bearing content reaches the client renderer intact.

Attack Vector

An authenticated attacker sends a Matrix message containing a crafted Markdown payload to a channel or session processed by the hermes-agent gateway. The MatrixAdapter._markdown_to_html path converts the payload into HTML that retains executable script constructs. When another user's client renders the message, the injected script runs in that user's client context. The attack requires user interaction (viewing the message) and can be executed remotely over the network.

No verified proof-of-concept code is reproduced here. See GitHub Issue #42667 and GitHub Pull Request #42759 for the technical discussion and proposed fix.

Detection Methods for CVE-2026-15311

Indicators of Compromise

Matrix messages containing raw HTML tags such as <script>, <img onerror=...>, or <iframe> traversing the gateway.
Gateway logs referencing MatrixAdapter._markdown_to_html processing unusually large or tag-heavy Markdown payloads.
Client-side errors or unexpected outbound requests originating from rendered chat content.

Detection Strategies

Inspect inbound Matrix traffic for Markdown payloads containing HTML script sinks or event-handler attributes.
Add server-side logging around _markdown_to_html to record pre- and post-conversion payloads for review.
Correlate authenticated user sessions with anomalous message payload sizes or embedded tag frequencies.

Monitoring Recommendations

Monitor the hermes-agent gateway process for outbound HTML content containing unsanitized <script> or event-handler attributes.
Track Content Security Policy (CSP) violation reports from Matrix web clients interacting with the gateway.
Alert on repeated message rejections or rendering errors that may indicate probing attempts.

How to Mitigate CVE-2026-15311

Immediate Actions Required

Restrict Matrix Adapter exposure to trusted, authenticated users until a patched release is available.
Apply the upstream fix from GitHub Pull Request #42759 once merged and released.
Review recent Matrix messages processed by the gateway for injected HTML or script content.

Patch Information

At the time of publication, the fix for CVE-2026-15311 is proposed in GitHub Pull Request #42759 and awaits acceptance. Track the Hermes Agent repository for the release that incorporates the patched MatrixAdapter._markdown_to_html implementation. Additional context is available at the VulDB entry for CVE-2026-15311.

Workarounds

Disable or isolate the Matrix Adapter component until the upstream patch is applied.
Front the gateway with an HTML sanitization proxy that strips script tags and event-handler attributes from converted output.
Enforce a strict Content Security Policy on any web client rendering hermes-agent output to limit script execution.

bash

# Configuration example: pin hermes-agent to a patched revision once released
pip install --upgrade "hermes-agent>2026.5.29.2"

# Interim: block the Matrix Adapter at the reverse proxy until patched
# nginx example
location /gateway/matrix/ {
    return 503;
}