This vulnerability affects cosmicstack-labs mercury-agent versions 1.1.0 through 1.1.12. The flaw resides in the PermissionManager.checkShellCommand function in src/capabilities/permissions.ts, which improperly assigns privileges when handling shell commands. This incorrect privilege assignment can be triggered remotely, potentially allowing an attacker to gain elevated privileges. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor has not issued any patch or official remediation guidance, and the project has not responded to the initial report. Public exploit information is available, but no confirmed exploitation in the wild is reported.

The vulnerability allows remote attackers to manipulate privilege assignments incorrectly, which could lead to unauthorized privilege escalation within the mercury-agent application. This may enable attackers to execute commands with higher privileges than intended, potentially compromising the affected system's security. However, the impact is rated medium based on the CVSS score and the absence of confirmed active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, consider restricting remote access to the mercury-agent service and applying compensating controls to limit potential exploitation.