CVE-2026-90813: mercury-agent Shell Command RCE Vulnerability

CVE-2026-90813 Overview

CVE-2026-90813 affects cosmicstack-labs/mercury-agent versions up to 1.1.13. The flaw resides in the checkShellCommand function within src/capabilities/permissions.ts, part of the Shell Command Execution component. The function performs validation before canonicalizing input, an incorrect behavior order classified as [CWE-179] (Incorrect Behavior Order: Early Validation). Attackers can craft shell command inputs that pass validation in their non-canonical form, then resolve to different commands after canonicalization. The issue is remotely reachable and requires only low-level privileges. A public exploit has been disclosed, and the maintainers have not yet responded to the upstream issue report.

Critical Impact
An authenticated remote attacker can bypass shell command allowlists in mercury-agent by supplying non-canonical input that passes validation before being resolved to a different command.

Affected Products

cosmicstack-labs/mercury-agent versions up to and including 1.1.13
Component: Shell Command Execution (src/capabilities/permissions.ts)
Function: checkShellCommand

Discovery Timeline

2026-09-14 - CVE-2026-90813 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD

Technical Details for CVE-2026-90813

Vulnerability Analysis

The checkShellCommand function is responsible for enforcing the permission model around shell command execution in mercury-agent. It validates command strings against an allowed set before the runtime canonicalizes them into their final form. Because validation happens against the raw, pre-canonicalization input, a command string can pass the safety check and still resolve to a different executable or argument set when actually invoked.

Exploitation requires network reachability and low-privilege authenticated access to the agent. The confidentiality impact is limited, with no direct integrity or availability impact reported. A public proof of concept is referenced in the GitHub Issue #95 Discussion and the VulDB CVE-2026-90813 Details.

Root Cause

The root cause is an incorrect behavior order [CWE-179]. Canonicalization — the process of resolving path separators, symbolic links, relative segments, and shell metacharacters into a normalized form — must occur before any allowlist or denylist comparison. In checkShellCommand, canonicalization runs after validation, so the string the validator inspects is not the string the shell ultimately executes.

Attack Vector

An attacker with low-privileged access to the agent supplies a shell command that appears benign to checkShellCommand. Once validation passes, the runtime canonicalizes the input, producing a resolved command that differs from the validated string. This allows the attacker to invoke commands outside the permission policy. Refer to the VulDB Vulnerability #403315 entry for the vulnerability record and to the upstream repository at GitHub Mercury Agent Repository for the affected source.

Detection Methods for CVE-2026-90813

Indicators of Compromise

Shell commands executed by mercury-agent containing path traversal segments (../), symlink references, or shell metacharacters (;, &&, |, backticks) that were not on the intended allowlist.
Divergence between the command string logged by checkShellCommand and the process actually spawned by the agent.
Repeated invocations of checkShellCommand with unusual encodings, redundant separators, or wrapped quoting patterns.

Detection Strategies

Instrument the agent to log both the pre-validation string and the post-canonicalization string, then alert when the two diverge into different resolved executables.
Correlate mercury-agent process telemetry with parent-child process trees to identify shells or binaries spawned outside the documented permission set.
Review the GitHub Issue #95 Discussion for exploit patterns and add matching signatures to your endpoint detection tooling.

Monitoring Recommendations

Forward mercury-agent audit logs and host process events to a centralized analytics pipeline for correlation.
Baseline the set of commands the agent normally executes and alert on deviations.
Track outbound activity from any host running mercury-agent version 1.1.13 or earlier until a patched release is available.

How to Mitigate CVE-2026-90813

Immediate Actions Required

Inventory all deployments of cosmicstack-labs/mercury-agent and confirm version numbers against 1.1.13 or earlier.
Restrict network access to the agent so only trusted, authenticated principals can reach the command interface.
Reduce the privilege of the account under which mercury-agent runs to limit the impact of any command that escapes validation.
Enable detailed command-execution logging and forward events to a SIEM or data lake for review.

Patch Information

At the time of publication, no fixed release has been announced. The maintainers have not yet responded to the upstream issue report. Monitor the GitHub Mercury Agent Repository and the VulDB CVE-2026-90813 Details page for updates.

Workarounds

Wrap checkShellCommand calls with a pre-step that canonicalizes input (resolve paths, strip redundant separators, normalize encoding) before validation runs.
Replace shell-string execution with an argv-array execution model that avoids invoking a shell interpreter.
Deploy an application-layer allowlist enforced outside the agent — for example, a wrapper script that re-validates the fully resolved command before spawning it.
Temporarily disable the Shell Command Execution capability in environments where it is not required.

bash

# Configuration example: run mercury-agent under a restricted, non-privileged account
# and block outbound shell activity that is not on an explicit allowlist.
useradd --system --shell /usr/sbin/nologin mercury-svc
chown -R mercury-svc:mercury-svc /opt/mercury-agent
systemctl edit mercury-agent  # add: User=mercury-svc, NoNewPrivileges=yes, ProtectSystem=strict