CVE-2026-27203

High

Published: 21 February 2026

Published

21 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

EPSS Score 0.0002 5.9th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27203 is a high-severity External Control of System or Configuration Setting (CWE-15) vulnerability. Its CVSS base score is 8.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly requires validation of inputs to the updateEnvFile function to block injection of arbitrary environment variables via unvalidated newlines or quotes.

SI-2 Flaw Remediation good match

prevent

Mandates timely identification, reporting, and correction of the input validation flaw in src/auth/oauth.ts to remediate the vulnerability.

CM-5 Access Restrictions for Change partial match

prevent

Restricts access to and verifies changes to configuration files like .env, limiting low-privilege attackers' ability to invoke the vulnerable ebay_set_user_tokens tool.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1574.006 Dynamic Linker Hijacking Stealth

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries.

attack.mitre.org →

T1574.007 Path Interception by PATH Environment Variable Stealth

Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries.

attack.mitre.org →

Why these techniques?

Env var injection vuln in network-accessible server directly enables T1190 exploitation for RCE/impact; facilitates T1574.006/007 hijacking via malicious PATH/LD_PRELOAD-style vars from .env overwrite.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to Environment Variable Injection through the updateEnvFile function. The ebay_set_user_tokens tool allows updating the .env…

file with new tokens. The updateEnvFile function in src/auth/oauth.ts blindly appends or replaces values without validating them for newlines or quotes. This allows an attacker to inject arbitrary environment variables into the configuration file. An attacker can inject arbitrary environment variables into the .env file. This could lead to configuration overwrites, Denial of Service, and potential RCE. There was no fix for this issue at the time of publication.

Deeper analysisAI

CVE-2026-27203 is an Environment Variable Injection vulnerability affecting all versions of the eBay API MCP Server, an open-source local MCP server that provides AI assistants with comprehensive access to eBay's Sell APIs. The issue resides in the updateEnvFile function within src/auth/oauth.ts, which is invoked by the ebay_set_user_tokens tool to update the .env file with new tokens. This function blindly appends or replaces values without validating them for newlines or quotes, enabling attackers to inject arbitrary environment variables into the configuration file.

The vulnerability has a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), indicating network accessibility, low attack complexity, and low privileges required. An attacker with low privileges, such as an authenticated user able to invoke the ebay_set_user_tokens tool, can inject malicious environment variables. This may result in configuration overwrites, denial of service, and potential remote code execution.

Mitigation details are available in the GitHub security advisory at https://github.com/YosefHayim/ebay-mcp/security/advisories/GHSA-97rm-xj73-33jh and a related commit at https://github.com/YosefHayim/ebay-mcp/commit/aab0bda75ea9dd27aa37d0d8524d7cf41b3c4a9a. There was no fix for this issue at the time of publication on 2026-02-21. The vulnerability is associated with CWEs CWE-15 and CWE-74.