CVE-2026-90810CWE-266CWE-285

CVE-2026-90810

Medium · published September 14, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.13. The impacted element is the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Command Permission Check. Performing a manipulation results in improper authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00366 · 29.2th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2026-09-14T23:18Z
References (7)
https://github.com/cosmicstack-labs/mercury-agent/ · [email protected]https://github.com/cosmicstack-labs/mercury-agent/issues/101 · [email protected]https://vuldb.com/cve/CVE-2026-90810 · [email protected]https://vuldb.com/submit/922876 · [email protected]https://vuldb.com/vuln/403312 · [email protected]https://vuldb.com/vuln/403312/cti · [email protected]https://vuldb.com/submit/922876 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 18:30Z
    cosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorization
    cvelistv5