eBay API MCP Server Environment Variable Injection Vulnerability

A vulnerability allowing environment variable injection has been identified in eBay API MCP Server, all versions. The issue arises in the 'updateEnvFile' function, which appends or replaces values in the .env file without proper validation. This flaw can be exploited using the 'ebay_set_user_tokens' tool, leading to unauthorized modifications of environment variables. Such injections could overwrite critical configuration settings, cause a denial-of-service by disrupting server operations, and in some cases, potentially allow remote code execution by manipulating certain environment variables.

Impact

Exploitation of this vulnerability allows for arbitrary injection of environment variables into the .env file, leading to configuration overwrites, denial-of-service conditions, and in some environments, remote code execution.