提出 #922876: cosmicstack-labs mercury-agent <= 1.1.13 Improper Authorization (CWE-285)

# Technical Details
A `run_command` safe-read approval bypass exists in the `checkShellCommand()` method in `mercury-agent/src/capabilities/permissions.ts` of Mercury Agent (npm package `@cosmicstack/mercury-agent`).

Mercury treats `find *` as a safe read-only shell pattern (`SAFE_READ_PATTERNS` includes `'find *'`, permissions.ts#L450-L509) and auto-approves any command segment that matches that coarse pattern without applying `find`-specific semantic validation. Options such as `-exec`, `-execdir`, `-ok`, `-okdir`, and `-delete` introduce side effects, but the approved string is later executed with full `find -exec` semantics through a real shell in `run_command` (`spawn(command, [], { cwd, shell: true, stdio: ['pipe','pipe','pipe'] })`, run-command.ts#L29-L33). An authenticated web user reaches this path via `POST /api/chat/send` -> `WebChannel.emitMessageInThread()` (src/web/api/chat.ts#L110-L123, src/channels/web.ts#L259-L273), which forwards user-controlled content into the agent tool loop. Verified against Mercury's real localhost web interface with a differential control: the control `sh -c 'printf ... > canary.txt'` produced one permission prompt and did not create the file after denial, while `find . -maxdepth 0 -exec sh -c 'printf GHSA-796m-2973-wc5q-find-exec-safe-read > canary.txt' ';'` produced zero prompts and created the canary file (logs show `"msg":"Shell command auto-approved (safe read-only)"` followed by `"msg":"Executing shell command"`).

# Vulnerable Code
File: mercury-agent/src/capabilities/permissions.ts (lines 450-509); sink in mercury-agent/src/capabilities/shell/run-command.ts (lines 29-33)
Method: PermissionManager.checkShellCommand() / run_command
Why: The approval layer reasons about `find ...` as a harmless file-search operation because `find *` is in SAFE_READ_PATTERNS and `allSegmentsSafeRead` auto-approves it, while the runtime executes the same string with `spawn(..., { shell: true })`, preserving dangerous `find -exec` semantics that launch `sh -c` subprocesses.

# Reproduction
1. Build Mercury from source with `npm run build`; no external model credentials required (harness starts a local OpenAI-compatible stub provider; default test login `mercury` / `Mercury@123`).
2. Download the shared web harness `mercury_web_harness.py` (https://gist.github.com/YLChen-007/e96fb4dd4cb352adc46d11d4f03a0d9c), the control script `control-direct-sh-write.py` (https://gist.github.com/YLChen-007/0f491c3af5d22cf72544105d0472b8d8), and the vulnerable scenario `verification_test.py` (https://gist.github.com/YLChen-007/37ce486a5bf3eb3fb06ba101db3967ec), then enter the exploit directory and run the control: `python3 control-direct-sh-write.py`.
3. Confirm the control result shows `Permission requests observed: 1` and that `control-home/workspace/canary.txt` was not created.
4. Run the exploit: `python3 verification_test.py` — the harness sends the `find -exec` payload through the real web auth flow, chat API, SSE permission channel, and tool dispatch.
5. Confirm the exploit result shows `Permission requests observed: 0` and that `verification-home/workspace/canary.txt` contains `GHSA-796m-2973-wc5q-find-exec-safe-read`.

# Impact
- Approval-bypass on a shell-execution sink: an authenticated Mercury web user (or any prompt source reaching `run_command`) can convert a read-only command family into actual subprocess execution without user approval.
- Arbitrary shell subprocess launch via `find -exec`, unauthorized file creation/modification inside the Mercury working directory, follow-on command execution against local developer assets, and exposure of repositories, config files, tokens, or other sensitive local state reachable under the Mercury runtime account.
- Severity High, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

• ソース: ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/101
• ユーザー: Eric-a (UID 96353)
• 送信: 2026年08月11日 15:07 (1 月 ago)
• モデレーション: 2026年09月13日 18:30 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 403312 [cosmicstack-labs mercury-agent 迄 1.1.13 Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand 特権昇格]
• ポイント: 20