CVE-2026-18996

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-18996
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18996.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-18996
Published
2026-08-06T04:15:09Z
Modified
2026-08-14T03:51:54Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment
Details

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component run_command Handler. Such manipulation leads to incorrect privilege assignment. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-266"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18996.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.1.1"
                },
                {
                    "last_affected": "1.1.1"
                },
                {
                    "introduced": "1.1.2"
                },
                {
                    "last_affected": "1.1.2"
                },
                {
                    "introduced": "1.1.7"
                },
                {
                    "last_affected": "1.1.7"
                },
                {
                    "introduced": "1.1.8"
                },
                {
                    "last_affected": "1.1.8"
                },
                {
                    "introduced": "1.1.10"
                },
                {
                    "last_affected": "1.1.10"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/cosmicstack-labs/mercury-agent

Affected ranges

Type
GIT
Repo
https://github.com/cosmicstack-labs/mercury-agent
Events
Introduced
8cee8ab40f6a5d5cdc5cb93feaeb103ef3a5eaec
Last Affected
587fad1bf9449598d1b27833f8c7db55d164741a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.1.0"
        },
        {
            "last_affected": "1.1.0"
        },
        {
            "introduced": "1.1.3"
        },
        {
            "last_affected": "1.1.3"
        },
        {
            "introduced": "1.1.4"
        },
        {
            "last_affected": "1.1.4"
        },
        {
            "introduced": "1.1.5"
        },
        {
            "last_affected": "1.1.5"
        },
        {
            "introduced": "1.1.6"
        },
        {
            "last_affected": "1.1.6"
        },
        {
            "introduced": "1.1.9"
        },
        {
            "last_affected": "1.1.9"
        },
        {
            "introduced": "1.1.11"
        },
        {
            "last_affected": "1.1.11"
        },
        {
            "introduced": "1.1.12"
        },
        {
            "last_affected": "1.1.12"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.1.0
1.1.11
1.1.12
1.1.3
1.1.4
1.1.5
1.1.6
1.1.9
v1.*
v1.1.0
v1.1.11
v1.1.12
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18996.json"