CVE-2026-19751
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A server-side request forgery (SSRF) vulnerability was found in the parse-csv tool of the EnzoVezzaro mcp-dominican-layer project, in the axios.get function in src/index.ts. The attack can be carried out remotely, and an exploit has been published. The project uses a rolling release strategy, so specific versions are not provided.
Risk Assessment
An attacker can exploit SSRF to send requests to internal network resources, potentially leading to disclosure of sensitive data or further attacks.
Recommendation
Monitor the project for updates and, if possible, restrict access to the tool or apply temporary mitigations such as URL filtering.
Original NVD description (English source)
A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.