CVE-2026-76842 mercadopago CVE debrief

Who should care

Developers and administrators using the Mercado Pago Node.js SDK should assess exposure and update the SDK to a fixed version to prevent potential exploitation. This involves reviewing and updating the SDK to ensure proper encoding of user-supplied identifiers in API request paths, implementing ownership checks for identifiers used in API requests, verifying affected versions, and assessing exposure in the environment. Additionally, monitoring for

Why it matters

The Mercado Pago Node.js SDK is vulnerable to path injection attacks, allowing an attacker to manipulate the request path and potentially access sensitive resources within the merchant's token scope. Developers and administrators should assess exposure and update the SDK to a fixed version to prevent potential exploitation.

• Path injection attacks can lead to unauthorized access to sensitive resources within the merchant's token scope.
• The vulnerability can be exploited by manipulating the request path using user-supplied identifiers.
• Verification of affected versions and exposure in your environment is necessary.
• Remediation priority is high due to the potential for exploitation and impact on sensitive resources.

Technical summary

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, allowing an attacker to manipulate the request path and potentially access sensitive resources within the merchant's token scope. The payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate) and disbursementRefund (create, createAll, listAll) clients build their path as a template literal, for example RestClient.fetch(`/v1/payments/${id}`, ...) in src/clients/payment/get/index.ts. The repository already contains the intended helper, encodePathParam in src/utils/path.ts, which pull request 451 applied to

Defensive priority

High

Recommended defensive actions

• Review and update the Mercado Pago Node.js SDK to ensure proper encoding of user-supplied identifiers in API request paths.
• Implement ownership checks for identifiers used in API requests to prevent unauthorized access.
• Verify the affected versions and assess exposure in your environment.
• Monitor for potential exploitation attempts and update the SDK to a fixed version.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected SDK and potential impact. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.