The flaw resides in MatrixAdapter._markdown_to_html within gateway/platforms/matrix.py. Untrusted markdown input is transformed into HTML without proper sanitization, allowing an attacker to inject malicious scripts. When this function processes user‑supplied content that is then displayed in a Matrix client, arbitrary scripts can run in the victim’s browser context. Credential theft, session hijacking, phishing or defacement – and it can be triggered remotely.

This vulnerability affects NousResearch’s hermes‑agent component, up to and including version 2026.5.29.2. Any deployment of hermes‑agent that exposes the MatrixAdapter endpoint to external inputs is at risk.

The CVSS base score of 5.1 indicates a moderate severity. The EPSS score is <1%, indicating a very low exploitation probability, but the exploit is publicly available, allowing an attacker to deploy malicious markdown messages remotely that get rendered in client‑side browsers, thereby creating a relatively high risk in environments where users consume Matrix content. The vulnerability is associated with CWE‑79 (XSS) and CWE‑94 (Code Injection).