8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27203

CVE-2026-27203: eBay API MCP Server Affected by Environment Variable Injection

The ebay_set_user_tokens tool allows updating the .env file with new tokens. The updateEnvFile function in src/auth/oauth.ts blindly appends or replaces values without validating them for newlines or quotes. This allows an attacker to inject arbitrary environment variables into the configuration file.

Impact

An attacker can inject arbitrary environment variables into the .env file. This could lead to:

Configuration Overwrites: Attackers can overwrite critical settings like EBAY_REDIRECT_URI to hijack OAuth flows.
Denial of Service: Injecting invalid configuration can prevent the server from starting.
Potential RCE: In some environments, controlling environment variables (like NODE_OPTIONS) can lead to Remote Code Execution.

Found with MCPwner 🕶

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27203

CVE-2026-27203:

8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ebay-mcp	npm	<= 1.7.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the updateEnvFile function located in src/auth/oauth.ts. The function is responsible for updating the .env configuration file. Prior to the patch, the function would read the .env file, and then for each key-value pair to be updated, it would use a regular expression to find and replace the line, or append a new line if the key did not exist. The new line was constructed as ${key}=\"${value}\". The value was not sanitized for newlines or other special characters. This allowed an attacker who could control the value to inject arbitrary content into the .env file, including new environment variable definitions. This could lead to configuration overwrites, denial of service, or potentially remote code execution. The patch addresses this vulnerability by replacing the manual file parsing and string manipulation with the dotenv and dotenv-stringify libraries. These libraries correctly parse and serialize the .env file, ensuring that values are properly quoted and escaped, thus preventing injection attacks.

Vulnerable functions

updateEnvFile

src/auth/oauth.ts

The `updateEnvFile` function was vulnerable to environment variable injection. It constructed the .env file content using direct string concatenation without sanitizing the input values. An attacker could provide a value containing a newline character to inject additional environment variables into the .env file. The patch mitigates this by using the `dotenv-stringify` library, which handles the proper escaping of values.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.