The SDK builds API request paths by directly interpolating caller‑supplied identifiers into literal strings. When an attacker supplies a value containing directory traversal or query string sequences, the WHATWG URL parser normalizes those characters and redirects the request to an unintended endpoint. The request still carries the merchant’s access token, which allows the attacker to query, modify, or otherwise interact with resources that the merchant should not expose. This effectively bypasses authorization controls and can expose sensitive payment data or permit unauthorized execution of payment operations.

Mercado Pago Node.js SDK version 3.4.0 and earlier. The vulnerability exists in payment, paymentRefund, advancedPayment, and disbursementRefund client modules that construct paths such as `/v1/payments/${id}` without encoding identifiers. The repository contains the helper function encodePathParam added in a later pull request, but these unchanged clients remain vulnerable in the specified release.

The CVSS score of 8.8 marks it as high severity, while the EPSS score is currently unavailable. Although not listed in the CISA KEV catalog, the flaw allows attackers to reach any API endpoint in the merchant’s token scope simply by forging an identifier passed to the SDK. The attack vector is local to the application code: an attacker must control the identifier that is passed to the SDK method. The absence of built‑in validation or encoding makes exploitation straightforward for any application that forwards untrusted identifiers to these SDK calls, and the impact is limited only by the scope of the merchant’s access token.