CVE-2026-90812
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability was found in cosmicstack-labs mercury-agent up to 1.2.0, affecting the checkShellCommand function in src/capabilities/permissions.ts. Manipulation leads to incorrect privilege assignment, and the attack can be initiated remotely. The exploit has been publicly disclosed.
Risk Assessment
Incorrect privilege assignment may allow an attacker to perform operations with higher privileges than intended, potentially leading to unauthorized access.
Recommendation
Update mercury-agent to the latest version if available, or apply a workaround to restrict access to the checkShellCommand function.
Other vulnerabilities in cosmicstack-labs mercury-agent
Original NVD description (English source)
A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Permission. The manipulation leads to incorrect privilege assignment. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS