CVE-2026-90814
cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
| CWE | CWE-918 |
| Vendor | cosmicstack-labs |
| Product | mercury-agent |
| Published | Sep 14, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for cosmicstack-labs mercury-agent
Be the first to know when new medium vulnerabilities affecting cosmicstack-labs mercury-agent are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
cosmicstack-labs / mercury-agent
1.1.0 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 1.1.7 1.1.8 1.1.9 1.1.10 1.1.11 1.1.12 1.1.13
References
vuldb.com: https://vuldb.com/vuln/403316 vuldb.com: https://vuldb.com/vuln/403316/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90814 vuldb.com: https://vuldb.com/submit/922880 github.com: https://github.com/cosmicstack-labs/mercury-agent/issues/81 github.com: https://github.com/cosmicstack-labs/mercury-agent/
Credits
🔍 Eric-a (VulDB User) VulDB CNA Team