Nothing open on GitHub. Fix merged in #61769 on 10 Jul 2026. Check it covers your case.
The short answer
- Known?
- Yes. 4 related items grouped here, 1 issue already closed.
- Fix event
- A fix was merged to main in PR #61769. Check it covers your case. No release data is tracked.
- Tracker
- The maintainers' tracker marks this
resolved, deciding PR #61345. That is separate from the fix event. - Still open
- Nothing open on GitHub.
A reported stored XSS vulnerability in HTML session exports, where tool-call names and other role-related fields were rendered unescaped, along with associated fixes adding HTML escaping and a nonce-based Content Security Policy.
Open issues0
Open PRs0
Fixes on record
-
#61345 fix(export): escape tool-call name in HTML session export
files:
hermes_cli/session_export_html.py,tests/hermes_cli/test_session_export_html.py -
#61769 fix(export): escape remaining role sinks + nonce-based CSP in HTML session export
files:
hermes_cli/session_export_html.py,scripts/release.py,tests/hermes_cli/test_session_export.py,tests/hermes_cli/test_session_export_html_escape.py
1 PR closed without merging
From the close comments: merged via another change 1
-
#61667 fix(session-export): escape HTML tool-call names · merged via another change →
c49d51b,#61769,#61345
Closed issues · 1
- Closed#61343[Bug]: Stored XSS in HTML session export via unescaped tool-call name
How this cluster was grouped
-
Link evidence (
structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference. -
Pairwise link density
0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36.1.00means every pair is linked.
Pick up a Lab task
Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.
Open the Lab