Quick answers
- Is CVE-2026-90813 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-90813 being exploited in the wild.
- How severe is CVE-2026-90813?
- Medium severity, with a CVSS score of 4.3, published 14 September 2026.
- Which products and versions are affected?
- Cosmicstack Labs Mercury Agent up to 1.1.13.
- Is there a fix for CVE-2026-90813?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-90813 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-90813?
- Check whether you run Cosmicstack Labs Mercury Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a time-of-check–time-of-use (TOCTOU) flaw in the shell command permission gate. The `checkShellCommand()` function in src/capabilities/permissions.ts validates commands in their pre-expansion form, checking for literal absolute paths (/, ~/, ..), before shell expansion occurs. However, the safe-read pattern whitelist includes patterns like `head *` which match commands with unexpanded variables. When the validated string is later executed via `spawn(..., { shell: true })` in src/capabilities/shell/run-command.ts, shell variable expansion occurs, allowing $HOME and other environment variables to resolve to absolute paths outside the workspace. An attacker can craft commands like `head $HOME/secret.txt` that pass validation as safe-read but execute with expanded privileges, bypassing the cwdOnly boundary check that would normally require user approval for absolute-path file access. No authentication bypass or privilege elevation is required; the attack relies on Mercury invoking run_command with attacker-controlled input.
Affected products
- cosmicstack-labs mercury-agent up to 1.1.13
Timeline
- 2026-09-14: disclosed
- exploited: Public exploit available; issue report filed but project has not yet responded