Why it matters
This is another agent framework whose shell-permission gate — the control meant to stop an LLM-directed command from executing unsafely — has multiple independently exploitable bypass paths, a recurring pattern across the day's agentic-tool disclosures (nanobot, mercury-agent, PraisonAI) suggesting shell-guard implementations across the ecosystem are systematically under-tested.
Attack vector
PermissionManager.checkShellCommand in mercury-agent validates commands before canonicalizing paths (CVE-2026-90813, CVSS 4.3), assigns incorrect privilege levels (CVE-2026-90812, CVSS 4.3), discloses permission-manifest information (CVE-2026-90811, CVSS 3.3), and a separate githubRequest utility is vulnerable to SSRF via the path argument (CVE-2026-90814, CVSS 6.3).
Affected systems
cosmicstack-labs mercury-agent up to 1.2.0
Mitigation
Track the cosmicstack-labs/mercury-agent GitHub repository for fixes across this cluster; treat the agent's shell-permission layer as unreliable until patched and add an independent command allow-list at the host/container boundary.