CVE-2026-15311: NousResearch hermes-agent Matrix Adapter XSS Vulnerability

Technical summary

The vulnerability exists in the MatrixAdapter._markdown_to_html function within gateway/platforms/matrix.py of NousResearch hermes-agent versions up to 2026.5.29.2. The root cause is insufficient input validation and output encoding during Markdown-to-HTML conversion. An authenticated user can craft specially formatted Markdown containing script tags or event handlers that bypass sanitization filters. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code), indicating both direct XSS and potential code generation risks. The attack surface is network-accessible and requires valid authentication credentials to exploit.

Business impact

This XSS vulnerability poses a lateral privilege escalation and session hijacking risk within organizations using hermes-agent for Matrix protocol integration. Compromised user sessions could allow attackers to impersonate legitimate users, exfiltrate sensitive conversations, or modify system configurations if those users have administrative privileges. For teams relying on hermes-agent for secure communications or sensitive workflow automation, the vulnerability undermines trust in message integrity. The impact is constrained by the requirement for valid user credentials and active browser interaction, reducing the risk of large-scale automated exploitation. However, targeted attacks against high-value users remain plausible.

Affected systems

NousResearch hermes-agent versions up to and including 2026.5.29.2 are affected. The vulnerability is specific to deployments using the Matrix Adapter component (gateway/platforms/matrix.py). Organizations running hermes-agent in production for Matrix protocol bridging should audit their deployment version immediately. Users on earlier versions are confirmed vulnerable; organizations should verify whether they have deployed any versions beyond 2026.5.29.2 as a temporary mitigation measure pending an official patch release.

Exploitability

The vulnerability is remotely exploitable but requires valid authentication credentials and user interaction, placing it in the LOW severity category per CVSS v3.1 (score 3.5). The presence of publicly available exploit code increases the likelihood of opportunistic attacks by insiders or those who have compromised valid credentials. The exploit does not require special technical skills once credentials are obtained—simple Markdown injection suffices. The bar for exploitation is moderate rather than trivial, reducing the risk of wormable spreading or mass automation, but organizations should still treat this as actionable within their patch management windows.

Remediation

Upgrade NousResearch hermes-agent to a patched version beyond 2026.5.29.2 as soon as it becomes available. The vendor's pull request to fix this issue is currently under review; monitor the NousResearch GitHub repository or security advisories for release announcements. Until an official patch is released, input validation can be strengthened by disabling or restricting Matrix Adapter functionality if not essential, or by implementing a Web Application Firewall (WAF) rule to detect and block Markdown payloads containing script tags in Matrix-bridged messages. Verify patch compatibility with your deployment architecture before rolling out updates to production.

Patch guidance

Verify availability of a patched version from NousResearch beyond 2026.5.29.2. Check the official NousResearch GitHub repository (https://github.com/NousResearch/hermes-agent) and their security advisory channels for patch release details and version numbers. When a patch becomes available, test it in a non-production environment first to confirm compatibility with your Matrix integration configuration and any custom modifications. Apply patches during a planned maintenance window and monitor application logs for any anomalies post-upgrade. If no patch has been released at the time of your assessment, escalate to NousResearch for an estimated remediation timeline.

Detection guidance

Monitor Matrix Adapter logs and gateway traffic for suspicious Markdown patterns, specifically payloads containing HTML script tags, event handler attributes (onclick, onerror), or encoded variants (<script>, &#60;script&#62;). Implement request/response inspection rules to flag Markdown messages with inline HTML or executable content destined for HTML rendering. Review access logs for authenticated sessions that generate unusual numbers of Markdown messages or messages from unexpected internal hosts. In application logs, search for conversion errors or sanitization bypass attempts in MatrixAdapter._markdown_to_html function calls. Consider deploying a WAF rule to block requests containing common XSS payloads in Markdown-formatted Matrix bridge traffic.

Why prioritize this

Although the CVSS score of 3.5 places this in the LOW severity bracket, the combination of public exploit availability, authenticated attack vector, and XSS impact on user sessions warrants timely remediation within a standard patch cycle (30–60 days). Prioritize this above theoretical vulnerabilities but below critical infrastructure risks. Organizations with high-value users or sensitive communications transiting hermes-agent should expedite patching. The pending pull request suggests a fix is imminent, so monitoring for patch availability should be treated as a near-term action item.

Risk score, explained

CVSS v3.1 base score of 3.5 reflects low severity: the vulnerability requires authentication (PR:L), low attack complexity (AC:L), remote access (AV:N), user interaction (UI:R), no privilege escalation (S:U), limited confidentiality impact (C:N), and low integrity impact (I:L) with no availability impact (A:N). While the score is low, the presence of public exploits and the practical attack scenario (authenticated insider or compromised credential holder injecting XSS) elevate real-world risk beyond the numerical score. CVSS does not account for organizational context (e.g., sensitivity of communications handled by hermes-agent), so security teams should adjust their own risk rating based on deployment criticality.

Frequently asked questions