Executive brief
Mercury Agent is an AI assistant tool that enforces permission controls over shell commands before execution. A flaw in the shell permission validator allows attackers to bypass approval checks by using shell metacharacters (like `echo $VAR`) that appear to be safe read-only operations but actually trigger shell variable expansion at execution time, enabling disclosure of sensitive environment variables without user approval.
Technical details
The vulnerability is an incorrect privilege assignment in the `checkShellCommand()` function within `src/capabilities/permissions.ts`. The permission manager whitelists `echo *` as a safe read-only pattern and auto-approves any command matching this pattern without prompting for user consent. However, the actual shell execution in `run_command.ts` uses `spawn(..., { shell: true })`, which means shell metacharacters and variable expansions (`$VAR`) are processed at runtime—after the permission decision is made. An attacker can craft commands like `echo $MERCURY_GHSA_JCCR_RRW2_VC8H_SECRET` that pass the superficial pattern check but trigger shell variable expansion to leak sensitive environment variables. The attack is remotely reachable via the authenticated Web chat API. No user interaction or additional privileges are required beyond access to the chat interface.
Affected products
- cosmicstack-labs mercury-agent up to 1.2.0
Timeline
- 2026-09-14: disclosed
- 2026-09-14: advisory: CVE-2026-90812