CVE-2026-90813: medium-severity vulnerability in cosmicstack-labs mercury-agent
cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.6%
A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
cosmicstack-labs · mercury-agentpublic PoCs found — 1
cve_referencegithub.com/cosmicstack-labs/mercury-agent/issues/95unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — cosmicstack-labs mercury-agent
In the same product, most dangerous first.
CVE-2026-18996MEDIUMcosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignmentEPSS 0.4%CVE-2026-90812MEDIUMcosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignmentEPSS 0.4%CVE-2026-90814MEDIUMcosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgeryEPSS 0.4%CVE-2026-90810MEDIUMcosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorizationEPSS 0.4%CVE-2026-18998MEDIUMcosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorizationEPSS 0.4%CVE-2026-18997MEDIUMcosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorizationEPSS 0.4%