Mercadopago
Monthly
Path traversal in the Mercado Pago Node.js SDK allows attackers who can influence payment, refund, or disbursement identifiers handled by merchant applications to redirect outbound API calls to unintended Mercado Pago endpoints, carrying the merchant's own access token. The affected clients - payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) - construct API paths via unencoded template literals, allowing dot-dot sequences and question marks to traverse to alternate endpoints or append attacker-chosen query parameters. No public exploit has been identified at time of analysis, and exploitation is conditional on merchant applications forwarding unvalidated, user-supplied identifiers directly to the SDK.
Path traversal in the Mercado Pago Node.js SDK allows attackers who can influence payment, refund, or disbursement identifiers handled by merchant applications to redirect outbound API calls to unintended Mercado Pago endpoints, carrying the merchant's own access token. The affected clients - payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) - construct API paths via unencoded template literals, allowing dot-dot sequences and question marks to traverse to alternate endpoints or append attacker-chosen query parameters. No public exploit has been identified at time of analysis, and exploitation is conditional on merchant applications forwarding unvalidated, user-supplied identifiers directly to the SDK.