Mercury-agent sandbox bypass via $HOME shell variable expansion

Vulnerability Summary Vulnerability Overview Title: [Security] Safe-read shell approval bypass allows out-of-workspace file disclosure via expansion ID: #95 Status: Open Type: Authorization Bypass Severity: Medium CWE: CWE-180: Incorrect Behavior Order: Validate Before Canonicalize CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Vulnerability Mechanism The permission gating in Mercury can be bypassed: 1. only identifies literal absolute paths (e.g., , ) and does not simulate shell variable expansion. 2. Consequently, is treated as a non-absolute path during the validation phase, passing the workspace boundary check. 3. The string is then passed to a real shell ( in ), where the shell expands , allowing files outside the workspace to be read. 4. An attacker can induce Mercury to invoke through a controlled prompt or agent task, bypassing the approval prompt that should originally block absolute path reads. Scope of Impact Ecosystem: npm Package: @cosmicstack/mercury-agent Affected Versions: < 1.1.18 Impact: Allows reading local files outside the active workspace, including secrets in the home directory, SSH materials, API keys, configuration files, and untracked project files. Does not require root privileges and does not depend on internal hooks. Key Code (POC / Exploit Related) 1. Trusting read-only commands like ( ) 2. Boundary Check and Auto-Approval ( ) 3. Absolute Path Identification (Does Not Handle Expansion) ```ts private hasPathIsAbsolutePath(command: string): string const pathPatterns = [ /^\/.$/, /^~\/.$/, /^\$HOME\/.$/, // Only matches literal $HOME, does not simulate expansion /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/, /^\/.$/

Goal Reached Thanks to every supporter — we hit 100%!

Mercury-agent sandbox bypass via $HOME shell variable expansion

More from this source