EUVD-2026-64848
GHSA-8vxq-h2gr-x277
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H: exploitation requires merchant app to forward untrusted IDs without validation; S:C: traversal reaches alternate API endpoints beyond the originally targeted resource.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate) and disbursementRefund (create, createAll, listAll) clients build their path as a template literal, for example RestClient.fetch(/v1/payments/${id}, ...) in src/clients/payment/get/index.ts. A dot-dot or slash sequence in the identifier is normalised by the WHATWG URL parser and redirects the request to a different endpoint, and a question mark appends attacker-chosen query parameters, in both cases carrying the merchant's own access token. An application that forwards an identifier influenced by an untrusted party into one of these methods without an ownership check therefore allows that party to reach other resources within the merchant's token scope. The repository already contains the intended helper, encodePathParam in src/utils/path.ts, which pull request 451 applied to roughly 29 other clients while leaving these unchanged.
Articles & Coverage 1
AnalysisAI
Path traversal in the Mercado Pago Node.js SDK allows attackers who can influence payment, refund, or disbursement identifiers handled by merchant applications to redirect outbound API calls to unintended Mercado Pago endpoints, carrying the merchant's own access token. The affected clients - payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) - construct API paths via unencoded template literals, allowing dot-dot sequences and question marks to traverse to alternate endpoints or append attacker-chosen query parameters. No public exploit has been identified at time of analysis, and exploitation is conditional on merchant applications forwarding unvalidated, user-supplied identifiers directly to the SDK.
Technical ContextAI
The vulnerability is rooted in CWE-22 (Path Traversal) as applied to server-side HTTP client path construction. The Mercado Pago Node.js SDK (CPE: cpe:2.3:a:mercadopago:mercadopago:*:*:*:*:*:*:*:*) uses ES6 template literals to embed caller-supplied identifiers directly into API request paths without percent-encoding, e.g., RestClient.fetch(/v1/payments/${id}, ...) in src/clients/payment/get/index.ts. The WHATWG URL parser, which normalizes percent-decoded traversal sequences before the HTTP request is dispatched, resolves dot-dot sequences to traverse to parent paths and preserves question-mark sequences as query string delimiters - both carrying the merchant's Authorization bearer token. The remediation helper encodePathParam already existed in src/utils/path.ts and was applied to approximately 29 other SDK clients in PR #451, but the payment, paymentRefund, advancedPayment, and disbursementRefund client families were omitted from that sweep, indicating the fix was a known remediation pattern that was incompletely applied.
RemediationAI
The primary fix is to apply the changes from PR #451 (https://github.com/mercadopago/sdk-nodejs/pull/451) or upgrade to an npm release that includes those changes. Developers should inspect their installed SDK version's src/clients/payment, src/clients/paymentRefund, src/clients/advancedPayment, and src/clients/disbursementRefund directories and confirm that every path construction wraps the identifier in encodePathParam - the same pattern already applied to customer, customerCard, chargeback, and invoice clients. As an immediate application-level compensating control that eliminates exploitability regardless of SDK version, merchant applications should validate that any payment, refund, or disbursement identifier received from an untrusted party is owned by or associated with the authenticated user before passing it to the SDK. Blocking at the API gateway is not a practical workaround because the traversal produces a legitimately structured outbound request from the SDK. The VulnCheck advisory is at https://www.vulncheck.com/advisories/mercado-pago-node-js-sdk-through-path-injection-via-unencoded-identifiers-in-payment-clients.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today