Incorrect Privilege Assignment in Cosmicstack Labs Mercury Agent
CVE-2026-90812

5.3MEDIUM

Key Information:

Vendor: Cosmicstack-labs
Status: Mercury-agent
Vendor: CVE Published:; 14 September 2026

🔔 Create Cosmicstack-labs Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-90812?

A vulnerability has been discovered in the Cosmicstack Labs mercury-agent, specifically impacting versions up to 1.2.0. This issue arises within the checkShellCommand function located in src/capabilities/permissions.ts and is characterized by incorrect privilege assignment for Shell Command Permission. As a result, this flaw could allow an attacker to execute commands with elevated privileges, potentially leading to unauthorized actions on the system. The attack can be initiated remotely, and despite the project’s awareness of the problem through an issue report, there has not been a response to mitigate the risk. Given the public disclosure of this exploit, it is essential for users to apply updates or implement security measures promptly.

Affected Version(s)

mercury-agent 1.0

mercury-agent 1.1

mercury-agent 1.2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-90812 - Proof of Concept