Skip to main content

Mercury Agent CVE-2026-90813

| EUVDEUVD-2026-77773 LOW
Incorrect Behavior Order: Validate Before Canonicalize (CWE-180)
2026-09-14 VulDB GHSA-9hv7-6jr2-3g59
Information Disclosure Mercury Agent
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Sep 15, 2026 - 10:45 vuln.today
Severity Changed
Sep 14, 2026 - 20:22 NVD
MEDIUM LOW
CVSS changed
Sep 14, 2026 - 20:22 NVD
5.3 (MEDIUM) 2.1 (LOW)
CVE Published
Sep 14, 2026 - 19:15 cve.org
LOW 2.1

DescriptionCVE.org

A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Mercury Agent versions through 1.1.13 gate shell execution by validating commands before canonicalizing them, so a caller with low privileges can craft input that passes the raw-string permission check yet resolves to a protected target, disclosing restricted data over the network. The flaw is a validate-before-canonicalize ordering error (CWE-180) in checkShellCommand within src/capabilities/permissions.ts, and publicly available exploit code exists via the project's own issue tracker. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mercury Agent

View all
CVE-2026-18996 LOW POC
2.1 Aug 06

Incorrect privilege assignment in cosmicstack-labs mercury-agent (all versions through 1.1.12) allows authenticated remo
CVE-2026-90810 LOW POC
2.1 Sep 14

Improper authorization in cosmicstack-labs mercury-agent's PermissionManager.checkShellCommand function (versions 1.1.0

CVE-2026-18998 LOW POC
2.1 Aug 06

Improper authorization in cosmicstack-labs mercury-agent's delegate_task tool allows a remotely authenticated low-privil
CVE-2026-18997 LOW POC
2.1 Aug 06

Incorrect authorization in cosmicstack-labs mercury-agent through version 1.1.12 allows remote authenticated attackers t
CVE-2026-90814 LOW POC
2.1 Sep 14

Server-side request forgery in cosmicstack-labs Mercury Agent (versions 1.1.0 through 1.1.13) lets an attacker who can i
CVE-2026-90811 LOW POC
1.9 Sep 14

A local information-disclosure weakness in cosmicstack-labs mercury-agent through version 1.2.0 lets a low-privileged lo

Same weakness CWE-180 – Incorrect Behavior Order: Validate Before Canonicalize

View all
CVE-2026-24895 CRITICAL POC
9.8
CVE-2026-39364 HIGH POC
8.2
CVE-2026-69246 HIGH POC
7.2
CVE-2026-69245 MEDIUM POC
6.5
CVE-2022-26136 CRITICAL
9.8
CVE-2026-73420 CRITICAL
9.1
CVE-2026-82481 HIGH
8.7
CVE-2022-26137 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-90813 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy