This vulnerability affects the cosmicstack-labs mercury-agent versions 1.1.0 through 1.1.13. The issue lies in the githubRequest function of src/utils/github.ts, where improper handling of the path argument enables server-side request forgery. An attacker can remotely exploit this flaw to make unauthorized requests from the server. Although the project was notified early, no official patch or remediation has been released. A public exploit exists, increasing the risk of exploitation.

Successful exploitation allows an attacker to induce the server to make arbitrary HTTP requests, potentially accessing internal resources or services not otherwise reachable. This can lead to information disclosure or further attacks within the server's network context. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3, indicating a moderate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, restricting network access from the mercury-agent server to only trusted endpoints and implementing input validation or filtering on the path argument may reduce risk.