●PocketClawAI security alerts
Sign in
lowCVSS 3.5NVD status: Deferred

CVE-2026-15311

Hermes Agent: A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2.

ComponentHermes Agent
Severitylow (CVSS 3.5)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Published (NVD)2026-07-10
Affected versionsnot published yet, see the advisory
Fixed insee the vendor advisory
WeaknessCWE-79CWE-94
CISA KEVnot listed

NVD description

A vulnerability was identified in NousResearch hermes-agent up to 2026.5.29.2. Affected by this issue is the function MatrixAdapter._markdown_to_html of the file gateway/platforms/matrix.py of the component Matrix Adapter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The pull request to fix this issue awaits acceptance.

Does CVE-2026-15311 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for Hermes Agent.
Check my stack

What to do

  • NVD lists no fixed version yet: follow the vendor advisory below and keep Hermes Agent off the public internet until a fix ships.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Other Hermes Agent CVEs

medium
CVE-2026-108593CVSS 6.4

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allow...

Hermes Agent
2026-10-10medium
CVE-2026-85106CVSS 6.3

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/ap...

Hermes Agent
2026-09-03high
CVE-2026-71963CVSS 8.8

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute...

Hermes Agent
2026-09-03medium
CVE-2026-85107CVSS 4.3

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file app...

Hermes Agent
2026-09-03high
CVE-2026-85105CVSS 7.3

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the com...

Hermes Agent
2026-09-03medium
CVE-2026-84288CVSS 4.3

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_ad...

Hermes Agent
2026-09-01