YosefHayim ebay-mcp up to 1.7.2 Environment Variable src/auth/oauth.ts updateEnvFile external control of setting

Summaryinfo

A vulnerability was found in YosefHayim ebay-mcp up to 1.7.2. It has been declared as critical. Affected by this vulnerability is the function updateEnvFile of the file src/auth/oauth.ts of the component Environment Variable Handler. Executing a manipulation can lead to external control of setting. This vulnerability appears as CVE-2026-27203. The attack may be performed from remote. There is no available exploit. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability classified as critical was found in YosefHayim ebay-mcp up to 1.7.2. This vulnerability affects the function updateEnvFile of the file src/auth/oauth.ts of the component Environment Variable Handler. The manipulation with an unknown input leads to a external control of setting vulnerability. The CWE definition for the vulnerability is CWE-15. One or more system settings or configuration elements can be externally controlled by a user. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to Environment Variable Injection through the updateEnvFile function. The ebay_set_user_tokens tool allows updating the .env file with new tokens. The updateEnvFile function in src/auth/oauth.ts blindly appends or replaces values without validating them for newlines or quotes. This allows an attacker to inject arbitrary environment variables into the configuration file. An attacker can inject arbitrary environment variables into the .env file. This could lead to configuration overwrites, Denial of Service, and potential RCE. There was no fix for this issue at the time of publication.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-27203 since 02/18/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available.

Applying the patch aab0bda75ea9dd27aa37d0d8524d7cf41b3c4a9a is able to eliminate this problem. The bugfix is ready for download at github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Auction Software

Vendor

• YosefHayim

Name

• ebay-mcp

Version

• 1.7.0
• 1.7.1
• 1.7.2

License

• open-source

Website

• Product: https://github.com/YosefHayim/ebay-mcp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion