CVE-2026-76842

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate) and disbursementRefund (create, createAll, listAll) clients build their path as a template literal, for example RestClient.fetch(`/v1/payments/${id}`, ...) in src/clients/payment/get/index.ts. A dot-dot or slash sequence in the identifier is normalised by the WHATWG URL parser and redirects the request to a different endpoint, and a question mark appends attacker-chosen query parameters, in both cases carrying the merchant's own access token. An application that forwards an identifier influenced by an untrusted party into one of these methods without an ownership check therefore allows that party to reach other resources within the merchant's token scope. The repository already contains the intended helper, encodePathParam in src/utils/path.ts, which pull request 451 applied to roughly 29 other clients while leaving these unchanged.

• CWE-22

• https://github.com/mercadopago/sdk-nodejs
• https://github.com/mercadopago/sdk-nodejs/blob/3.4.0/src/clients/payment/get/index.ts
• https://github.com/mercadopago/sdk-nodejs/pull/451
• https://www.vulncheck.com/advisories/mercado-pago-node-js-sdk-through-path-injection-via-unencoded-identifiers-in-payment-clients

Published

Aug 24, 2026

Last Modified

Aug 24, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76837Baserow interpolates a user's display name into the rich-tex…6.4
• CVE-2026-76838Hi.Events validates a webhook destination only when it is re…8.5
• CVE-2026-76839Grav before 2.0.16 allows sandboxed Twig templates to access…6.5
• CVE-2026-7684A security vulnerability has been detected in Edimax BR-6428…8.8
• CVE-2026-76840RustDesk's Windows clipboard redirection copies a peer-suppl…9.6
• CVE-2026-76841Xinference loads models with Hugging Face remote code execut…8.8
• CVE-2026-76843The official Flair wheels for 0.15.0 and 0.15.1 still contai…7.8
• CVE-2026-76844webpack-dev-middleware resolves a request to a local file in…7.4
• CVE-2026-76845adm-zip 0.5.9 through 0.6.0 follows symbolic links at the ex…6.5
• CVE-2026-76846Grav before 2.0.16 contains an incomplete default denylist i…7.5
• CVE-2026-76847act starts an HTTP Artifacts V4 backend whenever a workflow …8.8
• CVE-2026-76848TypeORM's SelectQueryBuilder.distinctOn accepts an array of …7.5