CVE-2026-90813

Summary

A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected Software

VendorProductVersion RangeStatus
cosmicstack-labsmercury-agent1.1.0affected
cosmicstack-labsmercury-agent1.1.1affected
cosmicstack-labsmercury-agent1.1.2affected
cosmicstack-labsmercury-agent1.1.3affected
cosmicstack-labsmercury-agent1.1.4affected
cosmicstack-labsmercury-agent1.1.5affected
cosmicstack-labsmercury-agent1.1.6affected
cosmicstack-labsmercury-agent1.1.7affected
cosmicstack-labsmercury-agent1.1.8affected
cosmicstack-labsmercury-agent1.1.9affected
cosmicstack-labsmercury-agent1.1.10affected
cosmicstack-labsmercury-agent1.1.11affected
cosmicstack-labsmercury-agent1.1.12affected
cosmicstack-labsmercury-agent1.1.13affected

Weaknesses

  • CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
  • CWE-179: Incorrect Behavior Order: Early Validation

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References