Path Injection Vulnerability in Mercado Pago Node.js SDK

CVE-2026-76842

What is CVE-2026-76842?

The Mercado Pago Node.js SDK suffers from a path injection vulnerability due to improper handling of caller-supplied identifiers in API request paths. This oversight allows an attacker to exploit structural characters within URLs leading to unintended resource access using the merchant's access token. The vulnerable methods within the payment, payment refund, and advanced payment clients fail to perform adequate ownership checks when forwarding identifiers influenced by untrusted sources. An attacker can manipulate an identifier to redirect API requests, potentially exposing sensitive information or capabilities. This risk arises from the absence of percent-encoding in URL constructions, which facilitates exploit opportunities through malicious query parameters. The repository includes a helper function, encodePathParam, intended to mitigate such vulnerabilities, though it was not applied to the affected clients.

References