The vulnerability in cosmicstack-labs mercury-agent (versions 1.1.0 through 1.1.13) arises from the checkShellCommand function executing validation before canonicalization, which is an incorrect order of operations. This can lead to security issues related to shell command execution. The flaw is remotely exploitable and public exploit code exists. The vendor has been notified but has not provided a fix or response at the time of this report.

The vulnerability allows remote attackers to potentially bypass intended validation checks on shell commands due to the incorrect order of validation and canonicalization. This could lead to unauthorized shell command execution or other unintended behaviors. The CVSS score of 5.3 indicates a medium impact level, with low attack complexity and no required user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates and consider implementing temporary mitigations such as restricting network access to the affected service or applying additional input validation controls where possible.