CVE-2026-90811: cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosure
A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Permission Manifest. Executing a manipulation can lead to information disclosure. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation is restricted to local execution and requires low privileges. The provided vector indicates no user interaction is required.
Which releases are affected?
cosmicstack-labs mercury-agent versions up to 1.2.0 are identified as affected.
Is public exploit code available?
Yes. The exploit has been made publicly available and could be used in attacks.
What is the expected impact?
The reported impact is information disclosure only. The supplied vector rates confidentiality impact as low and does not identify integrity or availability impact.
Is a vendor fix available?
The project was notified through an issue report but had not responded at the time of the report. No fix or mitigation is provided in the available data.