Threats tagged 'ghsa-7hmv-r6w5-pr73'

CVE-2026-18998 is a vulnerability in cosmicstack-labs mercury-agent up to version 1.1.12 affecting the SubAgent.run function in src/core/sub-agent.ts. It allows improper authorization due to a manipulation in the delegate_task Tool component. The vulnerability can be exploited remotely. Public exploit code has been disclosed, but the project has not yet responded or issued a fix.