Description

A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T20:17:02.510Z",
  "pubdate": "2026-09-14T20:17:02.510Z",
  "executiveSummary": "A critical vulnerability has been identified in the cosmicstack-labs mercury-agent, affecting versions up to 1.1.13. The vulnerability resides within the Shell Command Execution component, specifically in the checkShellCommand function located at src/capabilities/permissions.ts.\nThe issue stems from an incorrect logic sequence where input validation is performed prior to input canonicalization. This design flaw creates a security bypass scenario, enabling an attacker to submit obfuscated or malformed commands that pass validation checks but resolve to malicious or unauthorized operations after canonicalization.\nThe vulnerability can be exploited remotely without requiring prior authentication. Given that the exploit code is now public and the project maintainers have remained unresponsive to early disclosure, the risk of exploitation is significantly elevated. Successful exploitation allows for unauthorized command execution, potentially compromising the integrity and confidentiality of the host environment where the mercury-agent is deployed.\nUsers are advised to implement immediate compensating controls to restrict the execution capabilities of the agent until an official security patch is released by the vendor.",
  "technicalDetails": "The vulnerability is characterized by a flawed security control sequence within the checkShellCommand function in src/capabilities/permissions.ts. In robust secure development, canonicalization of user-supplied input must occur before any security validation or filtering. Canonicalization resolves inputs to their simplest, most direct form, ensuring that security checks evaluate the intended command rather than a representation that might contain path traversal sequences, double encoding, or other obfuscation techniques.\nIn the affected mercury-agent versions, the implementation performs validation (such as checking for forbidden characters or blacklisted command patterns) on the raw, uncanonicalized input. Once validation passes, the input undergoes canonicalization, at which point the internal representation of the command may change. This allows an attacker to bypass security filters by submitting input that appears benign during the initial check but transforms into a malicious payload during the subsequent canonicalization process.\nThe attack flow follows a specific progression: 1) The attacker crafts an input string specifically designed to bypass filter logic (e.g., utilizing character encoding or path separators that normalize into forbidden commands post-validation). 2) The crafted string is sent to the mercury-agent’s Shell Command Execution interface. 3) The checkShellCommand function processes the raw string against its security whitelist/blacklist, finding no violations. 4) The input is then passed through the system's canonicalization function. 5) The now-normalized malicious command is executed by the system shell with the privileges of the mercury-agent process.\nBecause this component is remotely accessible, an attacker can deliver this payload over the network. The impact is significant, as it facilitates arbitrary command execution, providing an attacker the ability to interact with the underlying operating system. This can lead to unauthorized data exfiltration, system configuration changes, or the installation of persistent malicious backdoors. The lack of a vendor patch increases the necessity for proactive network and application-layer defenses to mitigate the exposure of the agent's remote command interface."
}