CVE-2026-90812

MEDIUM 4.3

cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Permission. The manipulation leads to incorrect privilege assignment. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-266
Vendor	cosmicstack-labs
Product	mercury-agent
Published	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for cosmicstack-labs mercury-agent

Be the first to know when new medium vulnerabilities affecting cosmicstack-labs mercury-agent are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

cosmicstack-labs / mercury-agent

1.0 1.1 1.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/403314 vuldb.com: https://vuldb.com/vuln/403314/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90812 vuldb.com: https://vuldb.com/submit/922878 github.com: https://github.com/cosmicstack-labs/mercury-agent/issues/80 github.com: https://github.com/cosmicstack-labs/mercury-agent/

Credits

🔍 Eric-a (VulDB User) VulDB CNA Team