CVE-2026-18996 is a vulnerability in cosmicstack-labs mercury-agent versions up to 1.1.12. It affects the PermissionManager.checkShellCommand function within src/capabilities/permissions.ts of the run_command Handler component. The vulnerability allows an attacker to manipulate privilege assignments incorrectly, potentially escalating privileges remotely. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment). Although the project was notified early, no official fix or patch has been released. Public disclosure of the exploit exists, but no active exploitation has been reported.

The vulnerability can lead to incorrect privilege assignment, which may allow an attacker with some level of access to escalate privileges remotely. This impacts confidentiality, integrity, and availability to a limited extent, as reflected by the CVSS 3.1 score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No known active exploitation in the wild has been reported.

No official patch or fix is currently available for this vulnerability. Since the project has not responded or released a remediation, users should monitor the vendor's advisory channels for updates. Until a fix is provided, consider restricting remote access to the affected component and applying principle of least privilege to limit potential exploitation.