# CVE-2026-90812: cosmicstack-labs mercury-agent privilege escalation in shell permission check

Source: https://junglewise.ai/threats/cve-2026-90812-cosmicstack-labs-mercury-agent-privilege-escalation-in-shell  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90812 · Severity: medium · CVSS 4.3 · Published 2026-09-14

Mercury Agent is an AI assistant tool that enforces permission controls over shell commands before execution. A flaw in the shell permission validator allows attackers to bypass approval checks by using shell metacharacters (like `echo $VAR`) that appear to be safe read-only operations but actually trigger shell variable expansion at execution time, enabling disclosure of sensitive environment variables without user approval.

Technologies: [Cosmicstack Labs Mercury Agent](https://junglewise.ai/threats/technologies/mercury-agent). Vendors: [Cosmicstack Labs](https://junglewise.ai/threats/vendors/cosmicstack-labs).

## Quick answers

**Is CVE-2026-90812 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90812 being exploited in the wild.

**How severe is CVE-2026-90812?** Medium severity, with a CVSS score of 4.3, published 14 September 2026.

**Which products and versions are affected?** Cosmicstack Labs Mercury Agent up to 1.2.0.

**Is there a fix for CVE-2026-90812?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90812 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-90812?** Check whether you run Cosmicstack Labs Mercury Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an incorrect privilege assignment in the `checkShellCommand()` function within `src/capabilities/permissions.ts`. The permission manager whitelists `echo *` as a safe read-only pattern and auto-approves any command matching this pattern without prompting for user consent. However, the actual shell execution in `run_command.ts` uses `spawn(..., { shell: true })`, which means shell metacharacters and variable expansions (`$VAR`) are processed at runtime—after the permission decision is made. An attacker can craft commands like `echo $MERCURY_GHSA_JCCR_RRW2_VC8H_SECRET` that pass the superficial pattern check but trigger shell variable expansion to leak sensitive environment variables. The attack is remotely reachable via the authenticated Web chat API. No user interaction or additional privileges are required beyond access to the chat interface.

## Affected products

- cosmicstack-labs mercury-agent up to 1.2.0

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: advisory: CVE-2026-90812

## References

- [https://github.com/cosmicstack-labs/mercury-agent/](https://github.com/cosmicstack-labs/mercury-agent/)
- [https://github.com/cosmicstack-labs/mercury-agent/issues/80](https://github.com/cosmicstack-labs/mercury-agent/issues/80)

## Related threats

- [cosmicstack-labs mercury-agent server-side request forgery in GitHub API handler](https://junglewise.ai/threats/cve-2026-90814-cosmicstack-labs-mercury-agent-server-side-request-forgery-in)
- [cosmicstack-labs mercury-agent shell command validation bypass](https://junglewise.ai/threats/cve-2026-90813-cosmicstack-labs-mercury-agent-shell-command-validation-bypass)
- [Cosmicstack Labs Mercury Agent shell permission bypass via wc](https://junglewise.ai/threats/cve-2026-90811-cosmicstack-labs-mercury-agent-shell-permission-bypass-via-wc)
- [CosmicStack mercury-agent authorization bypass in shell command validation](https://junglewise.ai/threats/cve-2026-90810-cosmicstack-mercury-agent-authorization-bypass-in-shell-command)