Description

A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Permission Manifest. Executing a manipulation can lead to information disclosure. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T19:18:11.670Z",
  "pubdate": "2026-09-14T19:18:11.670Z",
  "executiveSummary": "A local information disclosure vulnerability exists in cosmicstack-labs mercury-agent versions up to 1.2.0, specifically within the Shell Permission Manifest component.\nThe flaw originates from improper input validation within the PermissionManager.checkShellCommand function, allowing unauthorized access to sensitive system information.\nThis vulnerability is restricted to local execution, requiring the attacker to have established access to the host environment.\nThe exploit is publicly available, increasing the risk of exploitation by local malicious actors or compromised low-privilege accounts seeking to escalate information collection.\nThe project maintainers have been notified, but no official patch or response is currently available, leaving systems exposed to potential reconnaissance and data leakage.",
  "technicalDetails": "The vulnerability resides in the mercury-agent/src/capabilities/permissions.ts file, specifically within the PermissionManager.checkShellCommand function. This function is responsible for validating and sanitizing shell commands executed through the mercury-agent framework.\nThe root cause is an insufficient validation mechanism within the logic governing the Shell Permission Manifest. The function fails to adequately restrict command arguments or enforce strict allow-listing, enabling an attacker to bypass intended security constraints via crafted input manipulations.\nAn attacker can exploit this by passing malicious parameters to the command execution interface exposed by the mercury-agent. Because the function does not properly sanitize or confine the execution context, a local user can coerce the agent into executing commands or accessing files that should be protected by the agent's permission model.\nThe attack flow involves the following steps: 1) The attacker gains local access to the target environment where mercury-agent is running. 2) The attacker invokes the target function, PermissionManager.checkShellCommand, through an interface provided by the agent. 3) The attacker injects malicious or unauthorized shell command arguments that manipulate the intended execution flow. 4) The PermissionManager, failing to identify the malicious input as non-compliant, permits the operation. 5) The agent executes the request, resulting in the unauthorized retrieval and leakage of system information that would otherwise be restricted to higher-privileged contexts or strictly authorized operations.\nExploitation is strictly local, meaning the attacker must be capable of executing code or commands on the host operating system. While the vulnerability does not directly provide remote code execution, it provides a powerful vector for information gathering and reconnaissance, which often serves as a prerequisite for more advanced secondary exploits.\nGiven that the exploit code is currently public, the barrier to entry is low for any local user, including unprivileged accounts or service accounts that have access to the agent's socket or CLI interface."
}