CVE-2026-90813

Name of the Vulnerable Software and Affected Versions cosmicstack-labs mercury-agent versions prior to 1.1.14

Description A remote attack is possible in the Shell Command Execution component due to an incorrect behavior order where validation occurs before canonicalization in the checkShellCommand() function within the src/capabilities/permissions.ts file. Canonicalization is the process of converting data into a standard or simplified form.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the checkShellCommand() function.