CVE-2026-18996

Name of the Vulnerable Software and Affected Versions cosmicstack-labs mercury-agent versions prior to 1.1.13

Description A remote issue exists in the run command Handler component within the PermissionManager.checkShellCommand() function located in the src/capabilities/permissions.ts file. Manipulation of this function can lead to incorrect privilege assignment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the PermissionManager.checkShellCommand() function to minimize the risk of exploitation.