CVE-2026-18997 is a vulnerability in the cosmicstack-labs mercury-agent software, specifically in the Agent.handleBgCommand function within src/core/agent.ts. This flaw allows remote attackers to manipulate background commands, resulting in incorrect authorization. The vulnerability affects versions up to 1.1.12. The issue was responsibly disclosed but remains unaddressed by the vendor. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, and impacts confidentiality, integrity, and availability at a low level.

The vulnerability allows remote attackers to bypass proper authorization checks, potentially leading to unauthorized actions within the affected component. The impact includes limited confidentiality, integrity, and availability loss. There is no evidence of active exploitation in the wild, but public exploit code exists.

No official patch or fix is currently available. Users should monitor the vendor's communications for updates. Until a fix is released, consider restricting network access to the affected service and applying compensating controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.