cosmicstack-labs mercury-agent — Multiple Privilege/Authorization Flaws in Command, Background, and Sub-Agent Handlers

NVD published CVE-2026-18996, CVE-2026-18997, and CVE-2026-18998 (all CVSS 6.3, Medium) on August 6, 2026, describing a cluster of privilege/authorization bugs across mercury-agent's command execution, background task, and sub-agent delegation handlers.

Multiple related authorization failures across an agent framework's privilege-checking, command-execution, and sub-agent-delegation code paths indicate systemic weakness in how the framework scopes agent capability boundaries.

PermissionManager.checkShellCommand incorrectly assigns privileges for the run_command handler; related flaws in Agent.handleBgCommand and SubAgent.run allow improper authorization for background command execution and sub-agent task delegation respectively — three related CVEs (18996, 18997, 18998) in the same codebase.

cosmicstack-labs mercury-agent ≤ 1.1.12

Upgrade to a patched mercury-agent release.