mercury-agent vulnerabilities

A vulnerability in cosmicstack-labs mercury-agent up to 1.1.12 affects the function SubAgent.run in src/core/sub-agent.ts, causing improper authorization. Remote attack is possible and exploit is public.

A vulnerability in cosmicstack-labs mercury-agent up to 1.1.12 affects the function Agent.handleBgCommand in src/core/agent.ts, causing incorrect authorization. Remote attack is possible and exploit is public.

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12, affecting the function PermissionManager.checkShellCommand in the file src/capabilities/permissions.ts in the run_command Handler component. Such manipulation leads to incorrect privilege assignment. The attack may be performed remotely, and the exploit has been publicly disclosed.