CVE-2026-27203: ebay-mcp Environment Variable Injection Vulnerability
Summary
CVE-2026-27203: eBay API MCP Server Affected by Environment Variable Injection. Affects ebay-mcp versions < 1.7.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ebay-mcp package is an npm library that facilitates interactions with the eBay API, allowing developers to manage user tokens and perform various operations related to eBay services. It is designed to streamline the authentication process and enhance user experience by securely handling OAuth tokens. However, a significant vulnerability exists in the way the package handles environment variables, potentially exposing applications to various security risks.
Vulnerability Detail
The vulnerability arises from the ebay_set_user_tokens tool, which updates the .env file with new tokens. The updateEnvFile function in src/auth/oauth.ts does not validate input for newlines or quotes, enabling attackers to inject arbitrary environment variables into the configuration file. This can lead to configuration overwrites, denial of service, and even potential remote code execution (RCE) in certain environments where environment variables like NODE_OPTIONS can be manipulated.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that the .env file is manually reviewed and sanitized before deployment. Additionally, avoid using the ebay_set_user_tokens tool until the package is updated to a secure version.
Conclusion
The ebay-mcp package has a critical vulnerability that allows for environment variable injection, posing significant risks to applications using it. It is crucial to update to the latest version to mitigate these risks and ensure the security of your application.
See every vulnerability recorded for ebay-mcp →
FAQ
An attacker can inject arbitrary environment variables, leading to configuration overwrites, denial of service, and potential remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
Yes, a patch is available in version 1.7.3 of the ebay-mcp package. Updating to this version will resolve the issue.
If you cannot update the package, ensure to manually sanitize the .env file and avoid using the vulnerable tool until a secure version is deployed.
