CVE-2026-18996
Published: Thu, 06 Aug 2026 05:16
Summary
A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts o
Details
A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component run_command Handler. Such manipulation leads to incorrect privilege assignment. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Are YOU affected by CVE-2026-18996?
5-second check on your actual server. Reads /etc/os-release, uname -r, and dpkg-query; matches against the live USN + Debian Security Tracker feeds; tells you whether CVE-2026-18996 (and any other live CVE) applies. Anonymous, no signup.
curl https://mindsparkstack.com/scan.sh | bash
References
- https://github.com/cosmicstack-labs/mercury-agent/
- https://github.com/cosmicstack-labs/mercury-agent/issues/72
- https://vuldb.com/cve/CVE-2026-18996
- https://vuldb.com/submit/862625
- https://vuldb.com/submit/862630
- https://vuldb.com/submit/862636
- https://vuldb.com/submit/862637
- https://vuldb.com/vuln/386379
- https://vuldb.com/vuln/386379/cti
StackPatch runs this match against YOUR installed packages every hour
Free (3 servers) / from $9/mo (14-day free trial) / Solo $9/mo / Pro $29/mo / Team $79/mo. Indie pricing.