{"id":"GHSA-97rm-xj73-33jh","summary":"eBay API MCP Server Affected by Environment Variable Injection ","details":"The `ebay_set_user_tokens` tool allows updating the `.env` file with new tokens. The `updateEnvFile` function in `src/auth/oauth.ts` blindly appends or replaces values without validating them for newlines or quotes. This allows an attacker to inject arbitrary environment variables into the configuration file.\n\n### Impact\nAn attacker can inject arbitrary environment variables into the `.env` file. This could lead to:\n- **Configuration Overwrites**: Attackers can overwrite critical settings like `EBAY_REDIRECT_URI` to hijack OAuth flows.\n- **Denial of Service**: Injecting invalid configuration can prevent the server from starting.\n- **Potential RCE**: In some environments, controlling environment variables (like `NODE_OPTIONS`) can lead to Remote Code Execution.\n\nFound with [MCPwner](https://github.com/Pigyon/MCPwner) 🕶","aliases":["CVE-2026-27203"],"modified":"2026-02-23T23:43:54.564312Z","published":"2026-02-19T20:27:11Z","database_specific":{"github_reviewed_at":"2026-02-19T20:27:11Z","nvd_published_at":"2026-02-21T00:16:17Z","cwe_ids":["CWE-15","CWE-74"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/YosefHayim/ebay-mcp/security/advisories/GHSA-97rm-xj73-33jh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27203"},{"type":"WEB","url":"https://github.com/YosefHayim/ebay-mcp/commit/aab0bda75ea9dd27aa37d0d8524d7cf41b3c4a9a"},{"type":"PACKAGE","url":"https://github.com/YosefHayim/ebay-mcp"}],"affected":[{"package":{"name":"ebay-mcp","ecosystem":"npm","purl":"pkg:npm/ebay-mcp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.7.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-97rm-xj73-33jh/GHSA-97rm-xj73-33jh.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H"}]}