Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-76842— Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

Quick assessment

Affected
mercadopago mercadopago
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

mercadopago是mercadopago公司的一个在线支付平台。 mercadopago 3.4.0及之前版本存在路径遍历漏洞，该漏洞源于将调用者提供的标识符插入API请求路径时未进行百分号编码，标识符中的点、斜杠或问号等URL结构字符可能导致路径遍历攻击，将请求重定向到不同端点或附加查询参数，并携带商户自己的访问令牌，从而使攻击者能够访问商户令牌范围内的其他资源。

CVSS 8.2 · High EPSS 0.49% · P41

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
mercadopago mercadopago ≤ 3.4.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76842

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients
Source: CVE Program / CVE List V5
Vulnerability Description
The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate) and disbursementRefund (create, createAll, listAll) clients build their path as a template literal, for example RestClient.fetch(`/v1/payments/${id}`, ...) in src/clients/payment/get/index.ts. A dot-dot or slash sequence in the identifier is normalised by the WHATWG URL parser and redirects the request to a different endpoint, and a question mark appends attacker-chosen query parameters, in both cases carrying the merchant's own access token. An application that forwards an identifier influenced by an untrusted party into one of these methods without an ownership check therefore allows that party to reach other resources within the merchant's token scope. The repository already contains the intended helper, encodePathParam in src/utils/path.ts, which pull request 451 applied to roughly 29 other clients while leaving these unchanged.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
mercadopago 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
mercadopago是mercadopago公司的一个在线支付平台。 mercadopago 3.4.0及之前版本存在路径遍历漏洞，该漏洞源于将调用者提供的标识符插入API请求路径时未进行百分号编码，标识符中的点、斜杠或问号等URL结构字符可能导致路径遍历攻击，将请求重定向到不同端点或附加查询参数，并携带商户自己的访问令牌，从而使攻击者能够访问商户令牌范围内的其他资源。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
mercadopago mercadopago 0 ~ 3.4.0 -

II. Public POCs for CVE-2026-76842

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Reproduced successfully in a real sandbox · Below is the actual recording of building the environment and exploiting the vulnerability.
Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+
claude_code · 9270 chars
GitHub 复现环境（可 clone 直接跑）
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-76842

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-76842 (1)

Vendor Advisories for CVE-2026-76842 (1)

IV. Related Vulnerabilities

Same vendor: mercadopago
Same weakness: CWE-22

V. Comments for CVE-2026-76842

No comments yet

Leave a comment