CVE-2026-76842: Mercado Pago Node.js SDK Path Traversal

CVE-2026-76842 Overview

CVE-2026-76842 is a path injection vulnerability in the Mercado Pago Node.js SDK. The SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them. Structural URL characters such as .., /, and ? survive into the outgoing request, allowing attackers to redirect the request to a different endpoint or append attacker-controlled query parameters. Because the SDK attaches the merchant's own access token to these requests, an attacker who influences an identifier passed to affected client methods can reach other resources within the merchant's token scope. The flaw is categorized as [CWE-22] Path Traversal.

Critical Impact
Untrusted input reaching affected client methods enables cross-resource access under the merchant's access token, exposing payment and refund data across the merchant's account.

Affected Products

Mercado Pago Node.js SDK payment client (get, capture, cancel)
Mercado Pago Node.js SDK paymentRefund client (create, total, list, get) and advancedPayment client (get, capture, cancel, update, updateReleaseDate)
Mercado Pago Node.js SDK disbursementRefund client (create, createAll, listAll)

Discovery Timeline

2026-08-24 - CVE-2026-76842 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-76842

Vulnerability Analysis

The affected clients build their request path with a JavaScript template literal, for example RestClient.fetch(/v1/payments/${id}, ...) in src/clients/payment/get/index.ts. When id originates from an untrusted party, the value is placed directly into the URL path without encoding. The WHATWG URL parser then normalises sequences such as ../ and interprets ? as the start of a query string. An attacker-controlled identifier can therefore rewrite the target endpoint or attach arbitrary query parameters. The outgoing request still carries the merchant's OAuth access token, so the redirected call is authenticated as the merchant. Applications that forward identifiers influenced by an untrusted party into an affected method, without first checking that the caller owns the resource, propagate this trust boundary violation to the Mercado Pago API.

Root Cause

The SDK exposes a helper named encodePathParam in src/utils/path.ts that wraps encodeURIComponent. Pull request 451 applied this helper to roughly 29 clients but left the payment, paymentRefund, advancedPayment, and disbursementRefund clients unchanged. Path parameters in those clients remain raw template-literal interpolations.

Attack Vector

The attacker supplies an identifier such as ../v1/other-endpoint or 123?filter=attacker to a downstream application that passes it into one of the affected methods. The SDK issues an authenticated request to the attacker-chosen URL. See the VulnCheck advisory and the payment client source for the vulnerable pattern.

No verified public exploit code is available. The vulnerability mechanism is documented in prose based on the referenced advisory and source.

Detection Methods for CVE-2026-76842

Indicators of Compromise

Outbound requests from application servers to api.mercadopago.com paths containing encoded traversal sequences such as %2E%2E%2F or unexpected path segments after /v1/payments/, /v1/advanced_payments/, or /v1/disbursement_refunds/.
Mercado Pago API access logs showing a single merchant token accessing resource IDs outside the expected sequence or belonging to unrelated buyers.
Application logs recording identifier parameters that contain .., /, ?, or # before being passed to SDK methods.

Detection Strategies

Static analysis rules that flag calls to payment.get, payment.capture, payment.cancel, paymentRefund.*, advancedPayment.*, and disbursementRefund.* where the identifier argument is not validated against a strict pattern such as ^[0-9]+$.
Runtime instrumentation on the HTTP client used by the SDK to alert when a request URL diverges from the expected /v1/payments/{numeric-id} shape.
Web application firewall rules that reject request parameters carrying traversal characters before they reach payment handlers.

Monitoring Recommendations

Correlate SDK version telemetry with the fixed release once published, and alert on hosts still running vulnerable versions.
Ingest application and API gateway logs into a centralized data lake to hunt for anomalous Mercado Pago request paths and query parameters.
Monitor for privilege-scope anomalies where one merchant token retrieves resources belonging to unrelated payments in a short time window.

How to Mitigate CVE-2026-76842

Immediate Actions Required

Inventory applications that consume the Mercado Pago Node.js SDK and identify code paths that forward external input into the affected client methods.
Add strict server-side validation on payment, refund, and advanced-payment identifiers, restricting them to the numeric format Mercado Pago issues.
Enforce an ownership check before invoking any affected SDK method, verifying that the authenticated user owns the referenced resource.

Patch Information

At publication the vendor patch that extends encodePathParam to the remaining clients had not been released. Track pull request #451 and the Mercado Pago Node.js SDK repository for the fixed version. Upgrade all deployed services once the patched release is available.

Workarounds

Wrap SDK calls in a thin internal client that applies encodeURIComponent to identifiers before passing them to the SDK, mirroring the behavior of the missing encodePathParam calls.
Reject any identifier that contains characters outside [0-9] at the application boundary, returning an error before invocation.
Reduce the scope of the Mercado Pago access token where the API permits, so a redirected request has minimal reachable surface.

bash

# Example allow-list validation before invoking the SDK
if [[ ! "$PAYMENT_ID" =~ ^[0-9]+$ ]]; then
  echo "Rejected non-numeric payment identifier" >&2
  exit 1
fi