Mercadopago vulnerabilities
We track 1 vulnerability in Mercadopago products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on August 24, 2026.
1vulnerabilities
0critical
1high
0exploited
8.2average CVSS score
Latest Mercadopago vulnerabilities
- 8.2 High severity
mercadopago: Improper Limitation of a Pathname to a Restricted Directory
The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment (get, capture, cancel), paymentRefund (create,