Description

A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Permission. The manipulation leads to incorrect privilege assignment. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T19:18:12.257Z",
  "pubdate": "2026-09-14T19:18:12.257Z",
  "executiveSummary": "The cosmicstack-labs mercury-agent, specifically versions up to 1.2.0, contains a critical vulnerability within the Shell Command Permission component. The vulnerability is classified as an improper privilege assignment flaw originating from the checkShellCommand function in src/capabilities/permissions.ts.\nThis security defect allows unauthorized actors to circumvent established security boundaries, leading to potential privilege escalation. The vulnerability is exploitable remotely, significantly increasing the risk surface as it does not necessarily require local access to the underlying infrastructure.\nGiven that the exploit has been disclosed publicly and the maintainers have not yet provided a resolution, the project is currently in an unpatched, vulnerable state. Organizations utilizing mercury-agent are at risk of arbitrary command execution or unauthorized access to sensitive system resources. The absence of a formal security response necessitates immediate defensive measures to prevent exploitation by malicious actors targeting this specific misconfiguration.",
  "technicalDetails": "The vulnerability resides in the checkShellCommand function located within src/capabilities/permissions.ts. The root cause of this flaw is an inadequate validation mechanism during the evaluation of shell command permissions. Instead of enforcing strict authorization checks, the function fails to correctly verify the context or the caller's privileges before executing or permitting specific shell-based operations.\nThe attack flow initiates with the remote adversary interacting with the mercury-agent service. By crafting specific inputs that interface with the Shell Command Permission component, an attacker can bypass the intended permission checks. The checkShellCommand function, intended to act as a gatekeeper, incorrectly processes the input, leading the application to grant elevated permissions that the requester should not possess. Essentially, the logic flaw causes the system to trust an unverified command request, resulting in improper privilege assignment.\nBecause the function fails to validate the authorization scope, the system effectively elevates the privileges of the remote attacker to those associated with the mercury-agent process. If the agent runs with elevated system or root privileges, the impact of this exploit is absolute, allowing the attacker to execute arbitrary shell commands on the host environment.\nThe exploitation process is straightforward due to the lack of sufficient input sanitization and logic enforcement within the vulnerable code path. An attacker sends a specially crafted payload via the network to the affected component. The vulnerable code path executes the request without checking if the sender has the necessary privileges to perform the requested shell operation. Consequently, the agent executes the payload, granting the attacker control over the shell operations.\nThis vulnerability is particularly dangerous as it is remotely exploitable, bypassing the need for physical or local terminal access. Post-exploitation, an attacker can maintain persistence, exfiltrate sensitive configuration data, or pivot further into the internal network infrastructure. Given the public disclosure of the exploit method, the probability of active exploitation by threat actors is high until the underlying logic in src/capabilities/permissions.ts is remediated."
}