CVE-2026-90814: cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges. Exploitation is network-reachable and does not require user interaction.

Q: What is the expected impact if exploitation succeeds?

The vulnerability is rated as having low impact on confidentiality, integrity, and availability. Its CVSS base score is 6.3, rated medium severity.

Published Sep 14, 2026

Updated

A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected Software

1 affected component

cosmicstack-labs/mercury-agent<=1.1.13

Event History

Sep 14, 2026

CVE Published

via MITRE·07:30 PM

Data Sourced

via MITRE·07:30 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges. Exploitation is network-reachable and does not require user interaction.

What is the expected impact if exploitation succeeds?