CVE-2026-76842: Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients
The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate) and disbursementRefund (create, createAll, listAll) clients build their path as a template literal, for example RestClient.fetch(/v1/payments/${id}, ...) in src/clients/payment/get/index.ts. A dot-dot or slash sequence in the identifier is normalised by the WHATWG URL parser and redirects the request to a different endpoint, and a question mark appends attacker-chosen query parameters, in both cases carrying the merchant's own access token. An application that forwards an identifier influenced by an untrusted party into one of these methods without an ownership check therefore allows that party to reach other resources within the merchant's token scope. The repository already contains the intended helper, encodePathParam in src/utils/path.ts, which pull request 451 applied to roughly 29 other clients while leaving these unchanged.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mercado Pago Node.js SDKto a version that resolves this vulnerability.Fixed in 3.4.0 - Configuration
In all payment clients that build API request paths with template literals (e.g., src/clients/payment/get/index.ts RestClient.fetch(`/v1/payments/${id}`, ...)), ensure the caller-supplied identifier is passed through the repository helper encodePathParam from src/utils/path.ts before interpolation so path structural characters (e.g., dot-dot or slash sequences) and query-appending characters cannot change the request endpoint or add attacker-chosen query parameters.
Mercado Pago Node.js SDK Path parameter encoding for caller-supplied identifiers = percent-encode/encodePathParam (src/utils/path.ts)
Event History
Frequently Asked Questions
Which applications are exposed?
Applications are exposed when they pass an identifier influenced by an untrusted party to an affected SDK method without verifying that the identifier belongs to the intended resource. The affected clients are payment, paymentRefund, advancedPayment, and disbursementRefund.
What does an attacker need to exploit this issue?
An attacker needs to influence an identifier supplied to an affected SDK method. Dot-dot or slash sequences can cause the request path to resolve to another endpoint, while a question mark can add attacker-controlled query parameters.
What could an attacker access through a successful exploit?
The altered request carries the merchant's access token. This can let the attacker reach other resources that are within that token's scope.
What can be done before an updated SDK is deployed?
Do not forward untrusted identifiers directly into the affected methods. Enforce ownership checks before use and percent-encode path parameters using the repository's existing encodePathParam helper.
How can I identify affected code?
Review calls to payment get, capture, and cancel; paymentRefund create, total, list, and get; advancedPayment get, capture, cancel, update, and updateReleaseDate; and disbursementRefund create, createAll, and listAll. Focus on call paths where the identifier originates from a request, user-controlled input, or another untrusted source.