This vulnerability affects the mercury-agent component of cosmicstack-labs, specifically the PermissionManager.checkShellCommand function in the file mercury-agent/src/capabilities/permissions.ts. Improper authorization occurs due to manipulation of this function, enabling remote attackers to bypass intended permission checks on shell commands. The issue impacts all versions from 1.1.0 through 1.1.13. Although an exploit is publicly available, there is no vendor response or patch at this time.

An attacker can remotely exploit this vulnerability to bypass shell command permission checks, potentially executing unauthorized commands. This improper authorization could lead to unauthorized actions within the affected system. The CVSS 4.0 score of 5.3 indicates a medium impact with low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting network access to the mercury-agent service and applying compensating controls to limit exposure.