Components
Vulnerabilities
Pricing
MCP
API
Docs
Sign up
Login
ebay-mcp 1.7.2 | Vulnerabilities | Sonatype Guide
npm
ebay-mcp
1.7.2
ebay-mcp 1.7.2
Published
Feb 8, 2026
•
Policy
compliance
npm Registry
Developer Trust Score
N/A
Recommended Version:
x.y.z
Latest version with 0 known vulnerabilities that meets your policy.
Compare Versions
Overview
Overview
Versions
20
Versions
20
Vulnerabilities
1
Vulnerabilities
1
Dependencies
14
Dependencies
14
Reset filters
Severity
Critical
(0)
High
(1)
Medium
(0)
Low
(0)
CVSS Score
0.0
10.0
EPSS Score
0.0
1.0
Malware
KEV Status
Published
Filter
Sort: Published (Newest first)
8.3
CVE-2026-27203
eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to Environment Variable Injection through the updateEnvFile function. The ebay_set_user_tokens tool allows updating the .env file with new tokens. The updateEnvFile function in src/auth/oauth.ts blindly appends or replaces values without validating them for newlines or quotes. This allows an attacker to inject arbitrary environment variables into the configuration file. An attacker can inject arbitrary environment variables into the .env file. This could lead to configuration overwrites, Denial of Service, and potential RCE. There was no fix for this issue at the time of publication.
affected
Severity
High
Published
Feb 20, 2026
