The vulnerability is located in the Slack Agent/Mattermost Agent component of NousResearch hermes‑agent. An attacker can manipulate the format_message argument to alter the output escaping logic, enabling the injection of arbitrary content. This defect, listed as CWE-116 (Improper Encoding of Output) and CWE-74 (Improper Validation of Input), could allow execution of malicious scripts or commands within the messaging environment, potentially resulting in remote code execution or unauthorized actions. The exploit is remote, publicly available, and can be triggered by any entity that can send a crafted format_message request.

Affected vendor: NousResearch; product: hermes‑agent; all releases up to and including 2026.4.16 are vulnerable. The flaw resides in the component responsible for handling Slack and Mattermost messages and applies to any platform or operating system where this agent is deployed.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, though the exploit is publicly shared. Exploitation requires remote access to the format_message functionality and can be carried out by sending a crafted request. The lack of a KEV listing does not negate the risk; the public nature of the exploit suggests a non‑negligible likelihood of targeted attacks against unpatched installations.