CVE-2026-90812: fallo de gravedad media en cosmicstack-labs mercury-agent
cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.4%
A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Permission. The manipulation leads to incorrect privilege assignment. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
cosmicstack-labs · mercury-agentPoCs públicas encontradas — 1
cve_referencegithub.com/cosmicstack-labs/mercury-agent/issues/80no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — cosmicstack-labs mercury-agent
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-90813MEDIUMcosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalizeEPSS 0.6%CVE-2026-18996MEDIUMcosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignmentEPSS 0.4%CVE-2026-90814MEDIUMcosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgeryEPSS 0.4%CVE-2026-90810MEDIUMcosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorizationEPSS 0.4%CVE-2026-18998MEDIUMcosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorizationEPSS 0.4%CVE-2026-18997MEDIUMcosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorizationEPSS 0.4%