{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.7.2"}],"component":"ebay-mcp","cve_ids":["CVE-2026-27203"],"ecosystem":"npm","epss":0.00401,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-97rm-xj73-33jh","id":"tcs_01M5KFF5AWERM5098C6W8T80K3","modified_at":"2026-02-23T23:43:54.564312Z","published_at":"2026-02-19T20:27:11Z","references":["https://osv.dev/vulnerability/GHSA-97rm-xj73-33jh","https://github.com/YosefHayim/ebay-mcp/security/advisories/GHSA-97rm-xj73-33jh","https://nvd.nist.gov/vuln/detail/CVE-2026-27203","https://github.com/YosefHayim/ebay-mcp/commit/aab0bda75ea9dd27aa37d0d8524d7cf41b3c4a9a","https://github.com/YosefHayim/ebay-mcp"],"severity":{"label":"high","score":8.3},"sources":[{"source":"osv","source_id":"GHSA-97rm-xj73-33jh","url":"https://osv.dev/vulnerability/GHSA-97rm-xj73-33jh"}],"summary":"eBay API MCP Server Affected by Environment Variable Injection"}