{"repo":"NousResearch/hermes-agent","public_id":"42667","display_label":"Matrix markdown HTML and link sanitization security concerns","summary":"The members concern sanitizing Matrix outbound markdown output: one issue reports raw HTML and `javascript:` links surviving in `formatted_body`, and two pull requests address sanitizing library HTML output and rejecting entity-encoded URL schemes in link handling. Their titles indicate a shared theme, but they do not confirm what the changes accomplish.","subsystem":"gateway","counts":{"members":3,"open_issues":1,"open_issues_distinct":1,"open_prs":1,"closed_issues":0,"merged_prs":0,"attempt_prs":2},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[],"members":[{"kind":"issue","number":42667,"title":"[Security] Unsafe Matrix Markdown Rendering Preserves Raw HTML and `javascript:` Links in Outbound `formatted_body`","url":null,"state":"open"},{"kind":"pr","number":42681,"title":"fix(matrix): reject entity-encoded URL schemes in _sanitize_link_url","url":null,"state":"open","close_reason":{"refs":[{"kind":"pr","value":"#42667","number":42667},{"kind":"pr","value":"#106","number":106}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":42684,"title":"fix(matrix): sanitize markdown library HTML output to prevent injection","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#42681","number":42681},{"kind":"pr","value":"#42667","number":42667}],"category":"superseded_by_pr","implication":"superseded"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true}],"trust":{"default_tier":"verified","includes_suggested":false}}