CVE-2026-18997
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability in cosmicstack-labs mercury-agent up to 1.1.12 affects the function Agent.handleBgCommand in src/core/agent.ts, causing incorrect authorization. Remote attack is possible and exploit is public.
Risk Assessment
Incorrect authorization could allow an attacker to execute unauthorized commands, potentially compromising system security. Public exploit increases risk.
Recommendation
Urgently update mercury-agent to a patched version and monitor for unauthorized activities.
Other vulnerabilities in mercury-agent
See all- CVE-2026-18998Medium
A vulnerability in cosmicstack-labs mercury-agent up to 1.1.12 affects the function SubAgent.run in src/core/sub-agent.ts, causing improper authorization. Remote attack is possible and exploit is public.
- CVE-2026-18996Medium
A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12, affecting the function PermissionManager.checkShellCommand in the file src/capabilities/permissions.ts in the run_command Handler component. Such manipulation leads to incorrect privilege assignment. The attack may be performed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.