The vulnerability affects the mercury-agent component of cosmicstack-labs, specifically the Agent.handleBgCommand function in src/core/agent.ts. Improper authorization checks allow remote attackers to manipulate background commands, potentially bypassing intended access controls. The issue impacts all versions up to and including 1.1.12. Although an exploit is publicly available, there is no indication of widespread exploitation. The vendor has not provided a remediation or patch at this time.

Successful exploitation could allow an attacker with network access to the mercury-agent service to perform unauthorized background commands, potentially leading to unauthorized actions within the affected system. The CVSS score of 5.3 reflects a medium impact with low complexity and no user interaction required. There is no evidence of active exploitation in the wild.

No official fix or patch has been released by the vendor. Users should monitor the vendor's communications for updates. Until a patch is available, consider restricting network access to the mercury-agent service to trusted sources only to reduce exposure. Review and implement additional access controls where possible to mitigate unauthorized command execution.