Path Traversal in Mercado Pago Node.js SDK

The Mercado Pago Node.js SDK (mercado-pago-sdk-nodejs) contains a vulnerability (CVE-2026-76842) where identifiers provided by a caller are interpolated directly into API request path templates without proper percent-encoding. This affects several client modules, including payment, paymentRefund, advancedPayment, and disbursementRefund. Because the underlying logic uses template literals - such as RestClient.fetch(/v1/payments/${id}, ...) - attackers can supply identifiers containing path traversal sequences (e.g., "../") or query parameter delimiters (e.g., "?").

When an application integrates this SDK and processes user-supplied input as an identifier without strict validation, an attacker can manipulate the resulting URL to reach arbitrary endpoints under the merchant's account. Because the request carries the merchant's original access token, the attacker effectively gains the ability to make authenticated requests to unintended resources, potentially leading to unauthorized data exposure or service manipulation. A mitigation exists in the form of the encodePathParam utility function, which was omitted from the affected modules during previous refactoring.

Impact

Successful exploitation allows an attacker to pivot from legitimate payment operations to other API endpoints within the same service scope. This could enable an attacker to exfiltrate sensitive payment information, list refund details, or cancel unauthorized transactions by manipulating the request path. Impact is high as it leverages the merchant's own authenticated session to bypass application-level authorization controls.

Recommendation

• Update the mercado-pago-sdk-nodejs package to the latest version once a fix is released.
• Audit existing implementations of the affected clients (payment, paymentRefund, advancedPayment, disbursementRefund) to identify where user-supplied input is passed as identifiers.
• Implement strict input validation or use the existing encodePathParam helper located in src/utils/path.ts for all dynamic path parameters before passing them to the SDK.
• Review application-level logs for suspicious API request patterns featuring anomalous path structures or unexpected query parameters originating from the SDK's outbound connections.