CVE-2026-90812CWE-266

CVE-2026-90812

Medium · published September 14, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
31.4
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Permission. The manipulation leads to incorrect privilege assignment. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00385 · 31.4th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-09-14T23:18Z
References (6)
https://github.com/cosmicstack-labs/mercury-agent/ · [email protected]https://github.com/cosmicstack-labs/mercury-agent/issues/80 · [email protected]https://vuldb.com/cve/CVE-2026-90812 · [email protected]https://vuldb.com/submit/922878 · [email protected]https://vuldb.com/vuln/403314 · [email protected]https://vuldb.com/vuln/403314/cti · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 19:00Z
    cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment
    cvelistv5