This vulnerability in cosmicstack-labs mercury-agent (versions 1.0, 1.1, and 1.2.0) involves incorrect privilege assignment due to a flaw in the checkShellCommand function located in src/capabilities/permissions.ts. The issue allows remote attackers to manipulate shell command permissions improperly, potentially granting elevated privileges. The vulnerability was reported early to the project but remains unaddressed, and a public exploit disclosure exists. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, and no user interaction required.

The vulnerability allows remote attackers to gain incorrect privilege assignments, which could lead to unauthorized actions or escalation of privileges within the affected system. Since the exploit is publicly disclosed, there is a risk of exploitation, although no known active exploitation in the wild has been reported.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's advisories for updates and consider implementing compensating controls to restrict access to the affected component until a patch is released.