CVE-2026-27203

eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to Environment Variable Injection through the updateEnvFile function. The ebay_set_user_tokens tool allows updating the .env file with new tokens. The updateEnvFile function in src/auth/oauth.ts blindly appends or replaces values without validating them for newlines or quotes. This allows an attacker to inject arbitrary environment variables into the configuration file. An attacker can inject arbitrary environment variables into the .env file. This could lead to configuration overwrites, Denial of Service, and potential RCE. There was no fix for this issue at the time of publication.

• CWE-15
• CWE-74

• https://github.com/YosefHayim/ebay-mcp/commit/aab0bda75ea9dd27aa37d0d8524d7cf41b3c4a9a
• https://github.com/YosefHayim/ebay-mcp/security/advisories/GHSA-97rm-xj73-33jh

Published

Feb 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27198Formwork is a flat file-based Content Management System (CMS…8.8
• CVE-2026-27199Werkzeug is a comprehensive WSGI web application library. Ve…5.3
• CVE-2026-2720The Hr Press Lite plugin for WordPress is vulnerable to unau…6.5
• CVE-2026-27200Rejected reason: Further research determined the situation d…
• CVE-2026-27201Rejected reason: Further research determined the situation d…
• CVE-2026-27202GetSimple CMS is a content management system. All versions o…7.5
• CVE-2026-27204Wasmtime is a runtime for WebAssembly. Prior to versions 24.…6.5
• CVE-2026-27205Flask is a web server gateway interface (WSGI) web applicati…4.3
• CVE-2026-27206Zumba Json Serializer is a library to serialize PHP variable…8.1
• CVE-2026-27208bleon-ethical/api-gateway-deploy provides API gateway deploy…7.8
• CVE-2026-2721The MailArchiver plugin for WordPress is vulnerable to Store…4.8
• CVE-2026-27210Pannellum is a lightweight, free, and open source panorama v…6.1