CVE-2026-76842

Name of the Vulnerable Software and Affected Versions Mercado Pago Node.js SDK versions prior to 3.4.1

Description Certain clients within the SDK interpolate caller-supplied identifiers into API request paths without percent-encoding them. This allows structural URL characters to remain in the outgoing request. Specifically, the payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) clients use template literals to build paths, such as RestClient.fetch(/v1/payments/${id}, ...). A dot-dot or slash sequence in the id variable is normalized by the WHATWG URL parser, potentially redirecting the request to a different endpoint. Additionally, a question mark can append attacker-chosen query parameters. Since these requests carry the merchant's access token, an application that forwards untrusted identifiers without ownership checks allows unauthorized access to other resources within the merchant's token scope.

Recommendations Update Mercado Pago Node.js SDK to version 3.4.1 or later. As a temporary mitigation, ensure that any identifier passed to the payment, paymentRefund, advancedPayment, and disbursementRefund clients is strictly validated or percent-encoded before being processed by the SDK.