CVE-2026-18997
cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-863 CWE-285 |
| Vendor | cosmicstack-labs |
| Product | mercury-agent |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for cosmicstack-labs mercury-agent
Be the first to know when new medium vulnerabilities affecting cosmicstack-labs mercury-agent are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
cosmicstack-labs / mercury-agent
1.1.0 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 1.1.7 1.1.8 1.1.9 1.1.10 1.1.11 1.1.12
References
vuldb.com: https://vuldb.com/vuln/386380 vuldb.com: https://vuldb.com/vuln/386380/cti vuldb.com: https://vuldb.com/cve/CVE-2026-18997 vuldb.com: https://vuldb.com/submit/862627 github.com: https://github.com/cosmicstack-labs/mercury-agent/issues/73 github.com: https://github.com/cosmicstack-labs/mercury-agent/
Credits
🔍 ChenMarry (VulDB User) VulDB CNA Team