Description

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate) and disbursementRefund (create, createAll, listAll) clients build their path as a template literal, for example RestClient.fetch(`/v1/payments/${id}`, ...) in src/clients/payment/get/index.ts. A dot-dot or slash sequence in the identifier is normalised by the WHATWG URL parser and redirects the request to a different endpoint, and a question mark appends attacker-chosen query parameters, in both cases carrying the merchant's own access token. An application that forwards an identifier influenced by an untrusted party into one of these methods without an ownership check therefore allows that party to reach other resources within the merchant's token scope. The repository already contains the intended helper, encodePathParam in src/utils/path.ts, which pull request 451 applied to roughly 29 other clients while leaving these unchanged.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-24T14:17:01.930Z",
  "pubdate": "2026-08-24T14:17:01.930Z",
  "executiveSummary": "A path traversal and request redirection vulnerability exists in the Mercado Pago Node.js SDK due to improper sanitization and lack of percent-encoding of caller-supplied identifiers interpolated into API request paths.\nThe vulnerability impacts specific API clients including payment, paymentRefund, advancedPayment, and disbursementRefund, which construct request paths using template literals such as RestClient.fetch(`/v1/payments/${id}`, ...).\nAn unauthenticated or remote attacker capable of supplying or influencing the identifier parameter can leverage path traversal sequences (such as dot-dot or slash) or query injection characters (such as question marks) to manipulate the resulting request path.\nBecause the WHATWG URL parser normalizes these sequences, outgoing HTTP requests are redirected to arbitrary API endpoints within the scope of the victim merchant's access token, effectively leaking sensitive merchant data or performing unauthorized state changes.\nExploitation requires an application utilizing the affected Mercado Pago Node.js SDK methods to forward untrusted, attacker-influenced identifiers without performing prior ownership or validation checks.\nRisk implications include unauthorized access to restricted API resources, data exfiltration, and privilege abuse under the authenticated context of the merchant's API token.",
  "technicalDetails": "The root cause of the vulnerability is the direct interpolation of unencoded, caller-supplied identifiers into URI path templates within various SDK client implementations, specifically located in src/clients/payment/get/index.ts and related modules.\nVulnerable components comprise the payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) clients, which utilize raw template literals like RestClient.fetch(`/v1/payments/${id}`, ...) instead of applying the existing path-encoding utility function, encodePathParam, defined in src/utils/path.ts.\nWhen an untrusted identifier containing structural URL characters—such as directory traversal sequences (../), forward slashes (/), or query delimiters (?)—is passed into these methods, the lack of percent-encoding allows structural characters to survive directly into the outgoing HTTP request path.\nThe attack flow proceeds as follows: 1) An attacker supplies a maliciously crafted identifier containing normalization sequences or query parameters to an application using the vulnerable SDK methods; 2) The application forwards this identifier directly into the SDK without adequate ownership checks; 3) The SDK interpolates the raw identifier into the request path template; 4) The underlying WHATWG URL parser normalizes the dot-dot or slash sequences, redirecting the outgoing request to a completely different API endpoint; 5) A supplied question mark allows the attacker to inject arbitrary query parameters into the request.\nThroughout this redirection, the request continues to carry the victim merchant's valid access token, granting the attacker the ability to interact with arbitrary resources and endpoints permitted under the merchant's token scope.\nAuthentication and privilege requirements depend on the host application exposing the vulnerable parameter to untrusted parties, while exploitation network exposure is constrained by the SDK's runtime environment communicating with the Mercado Pago API backend."
}