Chenmarry

**Name of the Vulnerable Software and Affected Versions** zhayujie CowAgent versions prior to 2.1.2 **Description** An issue exists in the Self-Evolution Review Agent component within the ` select tools()` function of the `agent/evolution/executor.py` file. A remote attacker can perform a manipulation that leads to incorrect authorization. **Recommendations** Update zhayujie CowAgent to version 2.1.2 or later. As a temporary mitigation, restrict access to the ` select tools()` function in the `agent/evolution/executor.py` file.

**Name of the Vulnerable Software and Affected Versions** hermes-agent versions prior to 0.16.1 **Description** An issue exists in the Memory Toolset component within the `hermes-agent/model tools.py` file. This flaw allows remote attackers to bypass access controls through manipulation of unknown functionality. **Recommendations** Update hermes-agent to a version later than 0.16.0. Restrict access to the `hermes-agent/model tools.py` file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** netease-youdao LobsterAI version 2026.6.10 **Description** A flaw in the MEDIA Path Handler component allows for remote information disclosure. The issue resides within the `parseMediaTokensFromText()` function located in the `src/renderer/services/artifactParser.ts` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `parseMediaTokensFromText()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** cosmicstack-labs mercury-agent versions prior to 1.1.13 **Description** A remote issue exists in the `run command` Handler component within the `PermissionManager.checkShellCommand()` function located in the `src/capabilities/permissions.ts` file. Manipulation of this function can lead to incorrect privilege assignment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `PermissionManager.checkShellCommand()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** cosmicstack-labs mercury-agent versions prior to 1.1.13 **Description** An issue in the bg Command Handler component allows for incorrect authorization through manipulation. This can be triggered remotely via the `Agent.handleBgCommand()` function located in the `src/core/agent.ts` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `Agent.handleBgCommand()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** cosmicstack-labs mercury-agent versions prior to 1.1.13 **Description** An issue exists in the `delegate task` Tool within the `SubAgent.run()` function located in the `src/core/sub-agent.ts` file. A remote attacker can perform a manipulation that leads to improper authorization, which occurs when a system fails to properly verify if a user has the necessary permissions to access a resource or perform an action. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the `SubAgent.run()` function to minimize the risk of exploitation.