CVE-2026-18997

Name of the Vulnerable Software and Affected Versions cosmicstack-labs mercury-agent versions prior to 1.1.13

Description An issue in the bg Command Handler component allows for incorrect authorization through manipulation. This can be triggered remotely via the Agent.handleBgCommand() function located in the src/core/agent.ts file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the Agent.handleBgCommand() function to minimize the risk of exploitation.