EUVD-2026-31566
GHSA-7pxq-5rjc-m2wr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in NousResearch hermes-agent up to 2026.4.16. The affected element is an unknown function of the component Slack Agent/Mattermost Agent. The manipulation of the argument format_message results in escaping of output. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers to manipulate message formatting in Slack and Mattermost integrations, potentially leading to information disclosure and service disruption. The vulnerability is exploitable via crafted format_message arguments with low attack complexity and requires no user interaction. Public exploit code is available via GitHub Gist. The vendor did not respond to early disclosure attempts, and no patch availability is documented.
Technical ContextAI
The vulnerability affects the Hermes Agent messaging integration layer, specifically the format_message argument handling in Slack Agent and Mattermost Agent components. This is classified as CWE-116 (Improper Encoding or Escaping of Output), indicating the agent fails to properly sanitize or escape output when formatting messages for chat platforms. The affected component (cpe:2.3:a:nousresearch:hermes-agent) processes user-controlled input and renders it to messaging platforms without adequate output encoding. This class of vulnerability typically allows attackers to inject control characters, escape sequences, or formatting directives that bypass intended message boundaries, potentially enabling data exfiltration through crafted responses or disruption of message integrity. The network attack vector suggests the vulnerability can be triggered through API endpoints or webhook handlers that process external message formatting requests.
RemediationAI
No vendor-released patch is documented at time of analysis, as the vendor did not respond to early disclosure. Until an official fix becomes available, implement the following compensating controls: Restrict network access to Hermes Agent API endpoints and webhook handlers to trusted IP ranges only, blocking untrusted external access to format_message functionality. Deploy a reverse proxy or web application firewall to inspect and sanitize format_message parameter inputs, blocking payloads containing escape sequences, control characters, or formatting directives outside expected schemas - note this may break legitimate advanced formatting features if used. Disable Slack Agent and Mattermost Agent components entirely if not operationally required, eliminating the attack surface - impact includes loss of chat platform integration capabilities. Implement strict input validation on all external message sources before passing to format_message, though effectiveness depends on understanding the specific escaping flaw. Monitor VulDB (https://vuldb.com/vuln/365317) and NousResearch project channels for vendor response or community patches. Consider migrating to alternative agent frameworks with active security maintenance if vendor remains unresponsive. Review audit logs for suspicious format_message API calls showing manipulation attempts, focusing on unusual character patterns or formatting directives.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today