CVE-2026-90812
A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Permission. The manipulation leads to incorrect privilege assignment. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.22%
- CWE
- CWE-266
- Published
- 2026-09-14
- Last modified
- 2026-09-16
Affected products
- cosmicstack-labs mercury-agent
- cosmicstack-labs mercury-agent
- cosmicstack-labs mercury-agent
Weakness type
Related vulnerabilities
- CVE-2026-78477 — The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This mak
- CVE-2026-84814 — WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability
- CVE-2026-81294 — WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability
- CVE-2026-78330 — Apache Syncope: Privilege escalation for admin user via JWT authentication
- CVE-2026-78267 — WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability
- CVE-2026-73390 — WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability
- CVE-2026-73347 — WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability
- CVE-2026-66682 — WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability