The Mercado Pago Node.js SDK constructs API request paths by directly interpolating caller-supplied identifiers into URL templates without applying percent-encoding. This flaw affects multiple clients such as payment, paymentRefund, advancedPayment, and disbursementRefund. Because characters like dot-dot sequences or slashes are normalized by the URL parser, an attacker can manipulate the request path to access different endpoints. Additionally, a question mark in the identifier can append arbitrary query parameters, all while using the merchant's access token. Although the SDK contains a helper function intended for encoding path parameters, it was not applied to these vulnerable clients, leaving them exposed to path traversal and query injection risks. This vulnerability is tracked as CVE-2026-76842 and is associated with CWE-22 (Path Traversal).

An attacker who can influence the identifiers passed to the affected SDK methods can cause the SDK to send requests to unintended API endpoints within the merchant's token scope. This can lead to unauthorized information disclosure or partial access to other resources. The vulnerability has a CVSS 3.1 score of 8.2 (high severity), indicating a significant confidentiality impact with low attack complexity and no required privileges or user interaction.

No official patch or fix is currently documented. Users of the Mercado Pago Node.js SDK should apply strict ownership checks on any identifiers supplied by untrusted parties before passing them to the affected methods. Additionally, applying percent-encoding to all path parameters using the existing encodePathParam helper function is recommended to prevent path traversal and query injection. Monitor the vendor's advisory channels for updates or official fixes.