Threat Intelligence Database

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-18997 is a medium severity vulnerability in cosmicstack-labs mercury-agent up to version 1.1.12. It involves incorrect authorization in the Agent.handleBgCommand function, allowing remote attackers to manipulate background commands improperly. The vulnerability has a publicly available exploit, but no official patch or remediation has been provided by the vendor yet.

CVE-2026-18996 is a medium severity vulnerability in cosmicstack-labs mercury-agent up to version 1.1.12. It involves incorrect privilege assignment due to a flaw in the PermissionManager.checkShellCommand function within the run_command Handler component. The vulnerability can be exploited remotely without user interaction. Although the issue was reported early, the vendor has not yet responded or provided a fix. Public exploit details are available, but no known active exploitation in the wild has been confirmed.