Server-Side Request Forgery Vulnerability in Cosmicstack Labs Mercury Agent
CVE-2026-90814

5.3MEDIUM

Key Information:

Vendor: Cosmicstack-labs
Status: Mercury-agent
Vendor: CVE Published:; 14 September 2026

🔔 Create Cosmicstack-labs Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-90814?

A vulnerability exists in the Cosmicstack Labs Mercury Agent, specifically within the GitHub API Handler. The issue pertains to the 'githubRequest' function in the src/utils/github.ts file, where improper handling of the argument path can lead to server-side request forgery. This flaw enables potential remote exploitation, allowing attackers to send unauthorized requests from the server to internal resources. Although this issue was reported early to the maintainers, they have yet to respond or provide a resolution. Users of Mercury Agent versions up to 1.1.13 are encouraged to review their configurations and remain vigilant against possible exploits.

Affected Version(s)

mercury-agent 1.1.0

mercury-agent 1.1.1

mercury-agent 1.1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-90814 - Proof of Concept