CVE-2026-27203: eBay API MCP Server RCE Vulnerability

CVE-2026-27203 Overview

CVE-2026-27203 is an Environment Variable Injection vulnerability affecting the eBay API MCP Server, an open source local MCP server that provides AI assistants with comprehensive access to eBay's Sell APIs. The vulnerability exists in the updateEnvFile function within src/auth/oauth.ts, which fails to properly validate user-supplied input before writing to the .env configuration file.

The ebay_set_user_tokens tool allows updating the .env file with new tokens, but the underlying updateEnvFile function blindly appends or replaces values without validating them for newlines or quotes. This lack of input sanitization enables attackers to inject arbitrary environment variables into the configuration file, potentially leading to severe security consequences.

Critical Impact

Attackers can inject arbitrary environment variables into the .env file, potentially leading to configuration overwrites, Denial of Service, and Remote Code Execution (RCE).

Affected Products

• eBay API MCP Server (all versions)
• Applications using the ebay_set_user_tokens tool
• Systems with exposed MCP server endpoints

Discovery Timeline

• 2026-02-21 - CVE-2026-27203 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-27203

Vulnerability Analysis

This vulnerability is classified under CWE-15 (External Control of System or Configuration Setting). The core issue stems from insufficient input validation in the token update mechanism. When the ebay_set_user_tokens tool processes user-supplied token values, it passes them directly to the updateEnvFile function without sanitizing special characters such as newlines (\n) or quotes.

Environment files (.env) use a simple key-value format where each line typically contains a single variable assignment. By injecting newline characters into a token value, an attacker can effectively append new lines to the file, allowing them to define additional environment variables beyond the intended scope.

The potential impact includes: configuration overwrites where existing environment variables can be redefined with malicious values; Denial of Service through corrupted configuration that prevents the application from starting; and potential Remote Code Execution if injected variables influence command execution or module loading paths.

Root Cause

The root cause is improper input validation in the updateEnvFile function located in src/auth/oauth.ts. The function accepts token values and writes them to the .env file without checking for or escaping dangerous characters. Specifically, the function fails to:

1. Validate that input values do not contain newline characters
2. Properly escape or quote values containing special characters
3. Sanitize input to prevent injection of additional key-value pairs

This allows an attacker who can control the token input to craft malicious payloads that break out of the intended variable assignment and inject arbitrary configuration.

Attack Vector

The attack is network-accessible and requires low privileges to execute. An attacker with access to the MCP server interface can exploit this vulnerability by providing a malicious token value containing newline characters followed by arbitrary environment variable assignments. For example, a token value like legitimate_token\nMALICIOUS_VAR=evil_value would result in both the legitimate token and the injected variable being written to the configuration file.

The security patch introduces proper handling using the dotenv and dotenv-stringify packages:

   StoredTokenData,
 } from '@/types/ebay.js';
 import { LocaleEnum } from '@/types/ebay-enums.js';
+import dotenv from 'dotenv';
+import stringify from 'dotenv-stringify';
 import { existsSync, readFileSync, writeFileSync } from 'fs';
 import { join } from 'path';