| Titre | cosmicstack-labs mercury-agent 1.1.12 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) |
|---|
| Description | # Technical Details
A sensitive information disclosure vulnerability exists in Mercury Agent's `run_command` shell approval system. In `src/capabilities/permissions.ts`, `SAFE_READ_PATTERNS` includes `echo *` and `checkShellCommand()` auto-approves any matching segment as safe read-only. However, in `src/capabilities/shell/run-command.ts`, the approved command is executed through `spawn(command, [], { shell: true })`, which performs shell variable expansion. A payload like `echo $SECRET_VAR` is approved as a read-only echo, but the shell expands the environment variable and reveals its value in the output without triggering an Ask Me approval prompt.
# Vulnerable Code
File: src/capabilities/permissions.ts (lines 450-509)
Method: PermissionManager.checkShellCommand() / SAFE_READ_PATTERNS
Why: `echo *` is classified as safe read-only but shell variable expansion is not considered as a sensitive data disclosure path.
File: src/capabilities/shell/run-command.ts (lines 29-33)
Method: executeCommand() / spawn()
Why: `spawn(command, [], { shell: true })` executes the approved command through a real shell, which expands environment variables at execution time.
File: src/web/api/chat.ts (lines 110-123)
Method: Chat API endpoint
Why: Authenticated web chat input reaches the agent tool loop through `POST /api/chat/send`, making the vulnerable path reachable.
# Reproduction
1. Set a canary environment variable in the Mercury process (e.g., `MERCURY_CANARY=secret_value`).
2. Send a chat prompt causing the model to invoke `run_command` with `echo $MERCURY_CANARY`.
3. Observe the command is auto-approved as "safe read-only" without a permission prompt.
4. The tool output contains the expanded environment variable value.
5. Confirm the control case (direct `printenv`) triggers a `permission_request` and is blocked.
# Impact
- Environment secrets stored in the Mercury process can be disclosed without an Ask Me prompt.
- Can leak provider API keys, bot tokens, or other local runtime credentials.
- Information disclosure bypass that undermines the Ask Me security model. |
|---|
| La source | ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/76 |
|---|
| Utilisateur | ChenMarry (UID 99089) |
|---|
| Soumission | 18/06/2026 09:38 (il y a 2 mois) |
|---|
| Modérer | 05/08/2026 21:41 (2 months later) |
|---|
| Statut | Dupliqué |
|---|
| Entrée VulDB | 386379 [cosmicstack-labs mercury-agent jusqu’à 1.1.12 run_command permissions.ts PermissionManager.checkShellCommand élévation de privilèges] |
|---|
| Points | 0 |
|---|