Description
A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑side request forgery
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a server‑side request forgery (CWE‑918) in the githubRequest function of the GitHub API handler within Mercury Agent. By manipulating the path argument, an attacker can cause the application to issue arbitrary HTTP requests to external servers. Remote exploitation is possible, allowing attackers to access internal resources, exfiltrate data or perform denial‑of‑service actions. The flaw is available in all releases up to and including 1.1.13 and has been publicly demonstrated.

Affected Systems

Mercury Agent from cosmicstack‑labs, versions up to 1.1.13. The affected component is the src/utils/github.ts file in the GitHub API handler of the agent.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an interface that leads to githubRequest, such as an exposed API endpoint or webhook handler, and it is inferred that a crafted payload could trigger outbound requests to arbitrary URLs.

Generated by OpenCVE AI on September 15, 2026 at 07:43 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest release of Mercury Agent that includes a fix for the SSRF vulnerability (if available) or apply a custom patch that validates the path argument before forwarding.
  • If an immediate patch is unavailable, modify the githubRequest function to reject absolute URLs and enforce a whitelist of allowable GitHub API endpoints, preventing arbitrary outbound requests.
  • Restrict Mercury Agent’s outbound network access by configuring firewall rules or container networking to permit connections only to the GitHub API and essential services, which blocks exploitation of the SSRF flaw against internal resources.

Generated by OpenCVE AI on September 15, 2026 at 07:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery
First Time appeared Cosmicstack-labs
Cosmicstack-labs mercury-agent
Weaknesses CWE-918
CPEs cpe:2.3:a:cosmicstack-labs:mercury-agent:*:*:*:*:*:*:*:*
Vendors & Products Cosmicstack-labs
Cosmicstack-labs mercury-agent
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Cosmicstack-labs Mercury-agent
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-15T13:56:09.903Z

Reserved: 2026-09-13T16:29:55.084Z

Link: CVE-2026-90814

cve-icon Vulnrichment

Updated: 2026-09-15T13:42:08.418Z

cve-icon NVD

Status : Deferred

Published: 2026-09-14T20:17:02.723

Modified: 2026-09-15T14:17:39.487

Link: CVE-2026-90814

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T07:45:15Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)