THREAT INTELLIGENCE REPORT — CVE-2026-76842

Executive Summary

CVE-2026-76842 is an unpatched path traversal (CWE-22) vulnerability in the Mercado Pago official Node.js SDK. The affected client methods interpolate caller-supplied identifiers directly into API request path templates without percent-encoding, enabling an attacker to redirect API calls to unintended endpoints within the merchant's authenticated token scope. Successful exploitation requires the application to pass an unvalidated, attacker-influenced identifier into one of the listed SDK methods without an ownership check; impact includes confidentiality loss (C:H) of other resources reachable under the same merchant access token and limited integrity impact (I:L).

Technical Analysis

The vulnerability resides in the Mercado Pago Node.js SDK's URL construction logic. The SDK builds request paths using template literals — for example, RestClient.fetch('/v1/payments/${id}', ...) in src/clients/payment/get/index.ts — where id is the caller-supplied identifier. The NVD description states that these identifiers are interpolated without percent-encoding. This means that characters which are structural in a URL (specifically . and / for path semantics, and ? for query-string separation) survive verbatim into the outgoing HTTP request.

The SDK's own documentation (per the NVD description) already contains a helper function, encodePathParam in src/utils/path.ts — applied in pull request 451 to roughly 29 other SDK clients. The affected clients, however, were left unchanged. This indicates the vulnerability is a known-intent deviation rather than an accidental omission, though the net effect is identical: the SDK fails to sanitize path parameters.

The NVD description explicitly identifies these affected client groups:

• payment — methods: get, capture, cancel
• paymentRefund — methods: create, total, list, get
• advancedPayment — methods: get, capture, cancel, update, updateReleaseDate
• disbursementRefund — methods: create, createAll, listAll

Exploitation mechanics. When an identifier such as ../../other_resource is placed inside a template literal, the WHATWG URL parser (used by Node.js's fetch or the SDK's HTTP layer) normalizes the dot-dot segments, collapsing them into a different path. Because the API base URL is fixed (e.g., https://api.mercadopago.com), a path like /v1/payments/../../v1/preapproval resolves to /v1/preapproval — a different endpoint entirely. The merchant's OAuth/access token is attached to the outgoing request implicitly (by the SDK's authentication layer), so the redirected request carries full authentication.

Similarly, an identifier containing ? appends attacker-chosen query parameters to the outgoing URL. This allows parameter injection — for example, switching a payment identifier to one that begins with ?status=...&...= to manipulate API behavior or select an alternate resource.

The CVSS vector confirms the core characteristics:

• AV:N — network-exploitable, no physical access
• AC:L — no special attack conditions
• PR:N — no privileges needed to initiate the attack (attacker only needs to influence an identifier)
• UI:N — no user interaction
• S:U — scope unchanged
• C:H — high confidentiality impact
• I:L — low integrity impact
• A:N — no availability impact

The vulnerability is fundamentally a path traversal / parameter injection hybrid caused by missing input encoding, not a backend bug in Mercado Pago's API.

Exploitation Scenarios

No public PoC or exploit code is available for this CVE. The attack chain described below is inferred from the vulnerability class and the NVD description. Insufficient technical detail is available to provide exact payload formats.

The chain requires an application that uses the affected Mercado Pago SDK methods with caller-supplied identifiers and does not perform an ownership check.

1. Reconnaissance/Preparation. The attacker first identifies a target application that integrates the Mercado Pago Node.js SDK. This can be done through public disclosure (SDK usage in package manifest is public), fingerprinting of HTTP responses referencing Mercado Pago endpoints, or by observing API traffic that includes /v1/payments/ path segments. Once identified, the attacker maps which endpoints the application exposes that accept user-controlled identifiers (e.g., payment IDs, refund IDs) and forwards them to SDK methods.

2. Flaw Trigger. The attacker crafts an HTTP request to the application that uses the affected endpoint, substituting a traversal-style identifier. Because the SDK does not percent-encode, a value like ../../preapproval/... (or equivalent path traversal) will survive into the URL. The WHATWG URL parser normalizes the dot-dot sequences, redirecting the request to a different API endpoint — all while the merchant's access token is automatically attached.

3. Payload/Execution. At the vulnerability-class level, the attacker performs a path traversal maneuver: the crafted identifier escapes the intended payment-scoped URL and lands on a higher-level or different-scoped API resource. Alternatively, query parameter injection via ? in the identifier allows the attacker to manipulate the request target's parameters. The request is indistinguishable from a legitimate SDK call to the backend, so no WAF or API-layer anomaly detection would flag it.

4. Post-Exploitation Impact. The attacker can read (C:H) any resource within the merchant's token scope — including other merchants' data if the token has cross-merchant scope (rare), or more commonly other payment records, refund records, preferences, or customer data associated with the same merchant account. Low integrity impact (I:L) could allow the attacker to trigger state-changing operations (e.g., a capture or cancel) on a resource they should not control, leading to financial or transactional tampering. No availability impact is expected.

Because the affected chain requires an application-level flaw (forwarding untrusted identifiers without an ownership check), direct exploitation of the SDK alone is not sufficient — the SDK is only the vehicle, not the entry point.

Impact Assessment

• Affected systems: All applications using the Mercado Pago Node.js SDK's payment, paymentRefund, advancedPayment, or disbursementRefund clients with user-influenceable identifier input.
• Business impact: Data breach of payment/refund records; unauthorized financial operations (captures, refunds, cancellations); regulatory penalties under PCI-DSS and local data protection law; reputation damage to merchants.
• Blast radius: Limited to the merchant's own API token scope (no cross-tenant impact expected under the SDK design), but within that scope the reach may extend to all resources accessible to the merchant's access token — potentially spanning multiple payment methods, refunds, advanced payments, and disbursement records.
• CVSS breakdown (informational): The 8.2 score reflects the high confidentiality impact (C:H) and ease of exploitation (AC:L, PR:N). The low integrity component caps the score below critical.

Detection Guidance

Sigma Rule

title: Mercado Pago SDK Path Traversal Attempt (CVE-2026-76842)
id: 5f31f3a7-6a19-4e2b-9f1c-0c8f3a6b2e11
status: experimental
description: Detects attempts to exploit path traversal in Mercado Pago SDK by observing suspicious identifiers in application API request paths.
logsource:
  category: application
  product: nodejs
detection:
  selection_payment:
    cs.method: 'GET|POST|PUT|DELETE'
    cs.uri_query|contains:
      - 'v1/payments/'
      - 'v1/payment_refunds/'
      - 'v1/advanced_payments/'
      - 'v1/disbursement_refunds/'
  selection_traversal:
    cs.uri|contains:
      - '..%2f'
      - '%2e%2e%2f'
      - '/../'
      - '%2e%2e/'
  selection_query_injection:
    cs.uri_query|contains: '?'
  condition: selection_payment and (selection_traversal or selection_query_injection)
level: high

YARA Rule

rule MercadoPago_SDK_PathTraversal_CVE_2026_76842 {
    meta:
        author = "ValterSiT Threat Intel"
        description = "Detect source code or request patterns for Mercado Pago SDK path traversal"
        cve = "CVE-2026-76842"
        date = "2026-03-01"
    strings:
        $sdk_class = "new Payment" ascii wide
        $sdk_method = "capture" ascii wide
        $fetch = "RestClient.fetch" ascii wide
        $path_payment = "/v1/payments/`" ascii wide
        $template = "${id}" ascii wide
        $traversal = "../" ascii wide
        $query = "?" ascii wide
    condition:
        (uint16(0) == 0x4D5A or $sdk_class) and any of ($sdk_method*) and
        ($fetch or $path_payment or $template) and any of ($traversal, $query)
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any \
(msg:"ETP Mercado Pago SDK Path Traversal (CVE-2026-76842)"; \
flow:to_server,established; \
http.uri; content:"/v1/payments/"; \
pcre:"/(?:\.\.\/|\.\.%2f|%2e%2e[\/]|%2e%2e%2f)/i"; \
classtype:web-application-attack; sid:2026076842; rev:1;)

Elastic Detection (EQL)

sequence by host.name, process.name with maxspan=5s
  [ process where process.name == "node" and
    event.type == "start" ]
  [ file where event.type == "access" and
    file.path : "*node_modules*mercado*" ]
  [ network where process.name == "node" and
    destination.port == 443 and
    http.request.uri : ("*/v1/payments/*", "*/v1/payment_refunds/*") and
    (http.request.uri : "*../*" or http.request.uri : "*?*") ]

Splunk SPL Query

index=proxy OR index=web 
| where match(uri, "/v1/(payments|payment_refunds|advanced_payments|disbursement_refunds)/") 
| where match(uri, "(\.\./|%2e%2e%2f|\.\.%2f)") OR match(uri, "\?")
| table _time, src_ip, dest_host, uri, user_agent
| stats count by src_ip, dest_host

Wazuh OSSEC Rule

<group name="mercadopago_sdk_path_traversal,">
  <rule id="998371" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.\./|%2e%2e%2f|\.\.%2f</field>
    <field name="url">v1/payments/|v1/payment_refunds/|v1/advanced_payments/|v1/disbursement_refunds/</field>
    <description>Mercado Pago SDK path traversal attempt detected (CVE-2026-76842)</description>
    <group>attacker,mercadopago,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch availability: No patch exists (patch confidence 0/4). Pull request 451 exists for the repository but does not cover the affected clients. Until a vendor fix is released, follow these steps in order of precedence.

1. Immediate mitigations (do today):

   • Add an application-layer input validation wrapper that rejects any identifier containing ., /, \, ?, #, or URL-encoded equivalents before passing it to any affected SDK method.
   • Implement strict ownership checks — verify that the resource ID belongs to the authenticated requesting user before invoking SDK methods.
   • Apply the SDK's own encodePathParam helper (from src/utils/path.ts) manually to all identifiers passed to payment, paymentRefund, advancedPayment, and disbursementRefund methods.
   • If you have local copies of the SDK, patch the affected client files to call encodePathParam on the identifier before constructing the template literal.

2. Short-term (within days):

   • Monitor vendor communication (Mercado Pago GitHub repository, npm registry advisory feed) for a proper fix; subscribe to relevant notifications.
   • Implement runtime anomaly detection: alert on any SDK-initiated request whose URL deviates from expected path patterns.

3. Long-term hardening:

   • Pin SDK versions and review dependency diffs in CI before deployment.
   • Consider replacing affected SDK usage with raw HTTP calls that explicitly percent-encode path parameters using encodeURIComponent.
   • Conduct a code audit of all call sites for the four affected client groups.
   • Add a policy that SDK updates are reviewed for security regressions before promotion.

References

1. NVD Entry — CVE-2026-76842: https://nvd.nist.gov/vuln/detail/CVE-2026-76842 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, score 8.2)
2. Mercado Pago Node.js SDK GitHub repository — pull request #451: https://github.com/mercadopago/sdk-nodejs/pull/451
3. Vendor advisory: Not yet issued (as of report date, no patch confirmation)
4. CISA Known Exploited Vulnerabilities Catalog: NOT listed (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
5. MITRE ATT&CK Technique Reference: T1190 — Exploit Public-Facing Application (https://attack.mitre.org/techniques/T1190/)

Threat actor activity: No campaigns, exploit-in-the-wild evidence, or threat actor associations are known at the time of writing. No exploit code or PoC has been publicly released.