A path traversal vulnerability in the Mercado Pago Node.js SDK (versions 3.4.0 and earlier) allows unauthenticated attackers to read sensitive system files.

This is an improper limitation of a pathname to a restricted directory (CWE-22) vulnerability. The flaw exists in the payment client logic, where unauthenticated attackers can supply malicious input to traverse directories and read unauthorized data.

The ability for an unauthenticated attacker to read arbitrary files from the server hosting the SDK poses a severe risk to data confidentiality. Given the CVSS score of 8.2, this high-severity vulnerability could lead to the exposure of configuration files, environment variables, or other sensitive credentials, potentially facilitating full system compromise.

Immediate Action: Update the Mercado Pago Node.js SDK to a version beyond 3.4.0, as indicated by the vendor security advisory.

Proactive Monitoring: Review application access logs for unusual patterns, such as sequences containing directory traversal characters like dot-dot-slash.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts targeted at application endpoints.

Public Exploit Available: No

This vulnerability represents a significant security risk due to its unauthenticated nature and the potential for sensitive data exposure. Organizations utilizing the Mercado Pago Node.js SDK should prioritize updating to the patched version immediately to eliminate the risk of directory traversal.