NewApp Monitoring is liveSign up free
AgentbeamBeta
AI agent vulnerability · Other MCP servers and tools

CVE-2026-27203: eBay API MCP Server Affected by Environment Variable Injection

highCVSS 3.1 8.3GHSA-97rm-xj73-33jh

The ebaysetusertokens tool allows updating the .env file with new tokens. The updateEnvFile function in src/auth/oauth.ts blindly appends or replaces values without validating them for newlines or quotes. This allows an attacker to inject arbitrary environment variables into the configuration file. Impact An attacker can inject arbitrary environment variables into the .env file.

Published Feb 19, 2026 · Updated Feb 23, 2026

Affected packages

ebay-mcp

Ecosystem
npm
Affected
<= 1.7.2
Fixed in
No patched version yet
Check
npm ls ebay-mcp

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

The ebay_set_user_tokens tool allows updating the .env file with new tokens. The updateEnvFile function in src/auth/oauth.ts blindly appends or replaces values without validating them for newlines or quotes. This allows an attacker to inject arbitrary environment variables into the configuration file.

Impact

An attacker can inject arbitrary environment variables into the .env file. This could lead to:

  • Configuration Overwrites: Attackers can overwrite critical settings like EBAY_REDIRECT_URI to hijack OAuth flows.
  • Denial of Service: Injecting invalid configuration can prevent the server from starting.
  • Potential RCE: In some environments, controlling environment variables (like NODE_OPTIONS) can lead to Remote Code Execution.

Found with MCPwner 🕶

Credited to nedlir.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries