CVE-2026-15311

EUVD-2026-42764
A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter._markdown_to_html of the file gateway/platforms/matrix.py of the component Matrix Adapter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 10%
Common Weakness Enumeration
References
https://github.com/NousResearch/hermes-agent/
https://github.com/NousResearch/hermes-agent/issues/42667
https://github.com/NousResearch/hermes-agent/pull/42759
https://vuldb.com/cve/CVE-2026-15311
https://vuldb.com/submit/852843
https://vuldb.com/vuln/377247
https://vuldb.com/vuln/377247/cti