{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/mercado-pago/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mercado-pago-sdk-nodejs"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Mercado Pago"],"content_html":"\u003cp\u003eThe Mercado Pago Node.js SDK (mercado-pago-sdk-nodejs) contains a vulnerability (CVE-2026-76842) where identifiers provided by a caller are interpolated directly into API request path templates without proper percent-encoding. This affects several client modules, including payment, paymentRefund, advancedPayment, and disbursementRefund. Because the underlying logic uses template literals - such as RestClient.fetch(\u003ccode\u003e/v1/payments/${id}\u003c/code\u003e, ...) - attackers can supply identifiers containing path traversal sequences (e.g., \u0026quot;../\u0026quot;) or query parameter delimiters (e.g., \u0026quot;?\u0026quot;).\u003c/p\u003e\n\u003cp\u003eWhen an application integrates this SDK and processes user-supplied input as an identifier without strict validation, an attacker can manipulate the resulting URL to reach arbitrary endpoints under the merchant's account. Because the request carries the merchant's original access token, the attacker effectively gains the ability to make authenticated requests to unintended resources, potentially leading to unauthorized data exposure or service manipulation. A mitigation exists in the form of the encodePathParam utility function, which was omitted from the affected modules during previous refactoring.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to pivot from legitimate payment operations to other API endpoints within the same service scope. This could enable an attacker to exfiltrate sensitive payment information, list refund details, or cancel unauthorized transactions by manipulating the request path. Impact is high as it leverages the merchant's own authenticated session to bypass application-level authorization controls.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the mercado-pago-sdk-nodejs package to the latest version once a fix is released.\u003c/li\u003e\n\u003cli\u003eAudit existing implementations of the affected clients (payment, paymentRefund, advancedPayment, disbursementRefund) to identify where user-supplied input is passed as identifiers.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or use the existing encodePathParam helper located in src/utils/path.ts for all dynamic path parameters before passing them to the SDK.\u003c/li\u003e\n\u003cli\u003eReview application-level logs for suspicious API request patterns featuring anomalous path structures or unexpected query parameters originating from the SDK's outbound connections.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-24T18:03:37Z","date_published":"2026-08-24T18:03:37Z","id":"https://feed.craftedsignal.io/briefs/2026-08-mercado-pago-path-traversal/","summary":"The Mercado Pago Node.js SDK fails to sanitize user-supplied identifiers, allowing attackers to perform path traversal or query parameter injection to access unintended API endpoints within the merchant's token scope.","title":"Path Traversal in Mercado Pago Node.js SDK","url":"https://feed.craftedsignal.io/briefs/2026-08-mercado-pago-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Mercado Pago","version":"https://jsonfeed.org/version/1.1"}