CVE-2026-90813 affects the cosmicstack-labs mercury-agent up to version 1.1.13 in the checkShellCommand function within src/capabilities/permissions.ts. The vulnerability arises from an incorrect order of operations where validation is performed before canonicalization, potentially allowing remote attackers to exploit shell command execution. The vulnerability is classified under CWE-179 (Improper Neutralization of Special Elements used in an OS Command). Public exploit code exists, but no official patch or vendor response has been recorded as of the publication date.

The vulnerability allows remote attackers to manipulate shell command execution due to improper validation order, potentially leading to incorrect behavior in command processing. The CVSS score is 4.3 (low severity), indicating limited confidentiality impact and no integrity or availability impact. No known exploits in the wild have been reported beyond the public exploit code.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. Until a fix is available, consider restricting access to the affected component and applying compensating controls to limit exposure.