CVE-2026-19752
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability in EnzoVezzaro mcp-dominican-layer up to version 39dd373786712650097ad31db27d5c477c8f9c82 affects the parse-pdf function in src/index.ts of the PDF Parsing component. Manipulation of the pdfUrl argument leads to server-side request forgery. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
An attacker can make requests from the server to internal resources, potentially leading to disclosure of sensitive information or attacks on other systems in the internal network.
Recommendation
Update mcp-dominican-layer to the latest version or apply patches. Restrict access to the parse-pdf function and validate URLs before use.
Original NVD description (English source)
A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.