CVE-2026-90813

MediumCVSS 4.3/10Last modified Sep 14, 2026

Description

A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Execution. The manipulation results in incorrect behavior order: validate before canonicalize. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-179CWE-180

Affected software

No affected versions have been published.

Timeline

Published
Sep 14, 2026
Last modified
Sep 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-908146.3A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the fiCVE-2026-908156.3A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file lCVE-2026-908164.3A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component DuraCVE-2026-908179.8An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in whicCVE-2026-908184.3A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfCVE-2026-908197.3A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotificCVE-2026-90829.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL InjectioCVE-2026-908204.3A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecCVE-2026-908215.4An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker tCVE-2026-908229.8FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerabiliCVE-2026-908239.8FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /uCVE-2026-908243.3A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of t