CVE-2026-18997

MEDIUM

cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization

Title source: cna
STIX 2.1

Description

A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-386380 | cosmicstack-labs mercury-agent bg agent.ts Agent.handleBgCommand authorization
https://vuldb.com/vuln/386380
Signature, Permissions Required signature permissions-required
VDB-386380 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/386380/cti
Third Party Advisory third-party-advisory
CVE-2026-18997 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-18997
Third Party Advisory third-party-advisory
Submit #862627 | cosmicstack-labs mercury-agent 1.1.12 Incorrect Authorization (CWE-863)
https://vuldb.com/submit/862627

Scores

CVSS v3 6.3
EPSS 0.0021
EPSS Percentile 11.2%
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-285 CWE-863
Status published
Products (13)
cosmicstack-labs/mercury-agent 1.1.0
cosmicstack-labs/mercury-agent 1.1.1
cosmicstack-labs/mercury-agent 1.1.10
cosmicstack-labs/mercury-agent 1.1.11
cosmicstack-labs/mercury-agent 1.1.12
cosmicstack-labs/mercury-agent 1.1.2
cosmicstack-labs/mercury-agent 1.1.3
cosmicstack-labs/mercury-agent 1.1.4
cosmicstack-labs/mercury-agent 1.1.5
cosmicstack-labs/mercury-agent 1.1.6
... and 3 more
Published Aug 06, 2026
Tracked Since Aug 06, 2026