CVE-2026-90814

Name of the Vulnerable Software and Affected Versions cosmicstack-labs mercury-agent versions prior to 1.1.14

Description A flaw in the GitHub API Handler component allows remote exploitation via server-side request forgery (SSRF), a technique where an attacker induces the server to make requests to an unintended location. The issue exists within the githubRequest() function located in the src/utils/github.ts file, where improper handling of the path argument enables this behavior.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the githubRequest() function to minimize the risk of exploitation.