CVE-2026-90812 is a vulnerability in cosmicstack-labs mercury-agent versions up to 1.2.0, specifically in the checkShellCommand function within src/capabilities/permissions.ts. The flaw causes incorrect privilege assignment, potentially allowing an attacker to gain elevated privileges remotely. The vulnerability was publicly disclosed, and while the project was notified early, no official response or patch has been released. The CVSS 3.1 base score is 4.3, with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and limited confidentiality impact.

The vulnerability allows remote attackers with low privileges to cause incorrect privilege assignment, potentially leading to limited confidentiality impact. There is no indication of integrity or availability impact. Exploitation could allow unauthorized privilege escalation within the affected software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor for official updates and consider restricting access to the affected component until a patch is available.