Executive brief
Mercury-agent is an AI agent framework that executes shell commands on behalf of users. A flaw in the shell command validation logic allows attackers to bypass file access restrictions by using environment variable expansion (e.g., $HOME) to read files outside the intended workspace boundary without triggering approval prompts. This could allow disclosure of sensitive local files.
Technical details
The vulnerability is a time-of-check–time-of-use (TOCTOU) flaw in the shell command permission gate. The `checkShellCommand()` function in src/capabilities/permissions.ts validates commands in their pre-expansion form, checking for literal absolute paths (/, ~/, ..), before shell expansion occurs. However, the safe-read pattern whitelist includes patterns like `head *` which match commands with unexpanded variables. When the validated string is later executed via `spawn(..., { shell: true })` in src/capabilities/shell/run-command.ts, shell variable expansion occurs, allowing $HOME and other environment variables to resolve to absolute paths outside the workspace. An attacker can craft commands like `head $HOME/secret.txt` that pass validation as safe-read but execute with expanded privileges, bypassing the cwdOnly boundary check that would normally require user approval for absolute-path file access. No authentication bypass or privilege elevation is required; the attack relies on Mercury invoking run_command with attacker-controlled input.
Affected products
- cosmicstack-labs mercury-agent up to 1.1.13
Timeline
- 2026-09-14: disclosed
- exploited: Public exploit available; issue report filed but project has not yet responded