| Title | CosmicStack Labs Mercury Agent (@cosmicstack/mercury-agent) <= 1.1.13 Incorrect Behavior Order - Validate Before Canonicalize (CWE-180) / Authorization Bypass / Path Traversal |
|---|
| Description | # Technical Details
A safe-read shell approval bypass allowing out-of-workspace file disclosure via `$HOME` expansion exists in the `checkShellCommand` method in `src/capabilities/permissions.ts` of Mercury Agent.
Mercury validates safe-read shell commands before shell expansion. A command such as `head $HOME/secret.txt` is treated as a safe read during policy evaluation (because `head *` is whitelisted in `SAFE_READ_PATTERNS`), but the same string is later executed through a real shell (`spawn(command, [], { shell: true })`) which expands `$HOME` into an absolute path outside the workspace. The `hasPathBeyondCwd()` boundary check only recognizes literal path syntaxes (`/...`, `~/...`, `../...`, Windows drive paths, UNC paths) and does not model shell variable expansion, so `$HOME/secret.txt` survives the workspace-boundary check. As a result, an attacker who can induce `run_command` can read local files beyond the intended `cwdOnly` boundary without triggering the approval prompt that blocks the equivalent literal absolute path.
# Vulnerable Code
File: src/capabilities/permissions.ts
Method: checkShellCommand() / hasPathBeyondCwd()
Why: SAFE_READ_PATTERNS trusts `head *`; checkShellCommand() performs the workspace-boundary check before shell expansion and auto-approves commands when every segment matches a safe-read pattern. hasPathBeyondCwd() only detects literal path forms and misses shell-variable paths like `$HOME/secret.txt` (CWE-180: validate before canonicalize).
File: src/capabilities/shell/run-command.ts
Method: run_command execution sink
Why: `const child = spawn(command, [], { cwd, shell: true, stdio: ['pipe','pipe','pipe'] })` executes the approved pre-expansion string with real shell semantics, expanding `$HOME` into the out-of-workspace filesystem path after the permission decision.
# Reproduction
1. Check out `cosmicstack-labs/mercury-agent` at or before v1.1.13 with dependencies installed.
2. Create a canary file outside the workspace, e.g. `$HOME/outside-home/secret.txt` containing `cve-2026-28463-vuln-canary`.
3. Control: run `head /<absolute-path>/outside-home/secret.txt` via run_command — observe approval prompt and access-denied (`Error: No permission to access ...`).
4. Exploit: run `head $HOME/outside-home/secret.txt` via run_command — no approval prompt, returns the canary value.
5. Data flow: CapabilityRegistry.getTools().run_command -> PermissionManager.checkShellCommand() -> SAFE_READ_PATTERNS matches `head *` -> spawn(shell) -> shell expands $HOME -> out-of-workspace file read.
# Impact
- Authorization-bypass flaw in Mercury's shell safety boundary: auto-approved read commands can escape the current workspace.
- Disclosure of local files outside the active workspace: home-directory secrets, SSH material, API keys, configuration files, unrelated project source.
- Does not require allow-all mode or internal-only hooks.
- Severity: Medium, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. |
|---|
| Source | ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/95 |
|---|
| User | Eric-a (UID 96353) |
|---|
| Submission | 08/11/2026 15:11 (1 month ago) |
|---|
| Moderation | 09/13/2026 18:30 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 403315 [cosmicstack-labs mercury-agent up to 1.1.13 Shell Command Execution permissions.ts checkShellCommand validate before canonicalize] |
|---|
| Points | 20 |
|---|