Description
A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the parse-pdf function of EnzoVezzaro mcp-dominican-layer. By manipulating the pdfUrl argument, an attacker can cause the server to issue an HTTP request to an arbitrary URL. This enables the attacker to reach internal resources or misdirect traffic, compromising confidentiality and integrity of the system’s communication channels. The vulnerability allows remote exploitation, and an exploit has already been made public.

Affected Systems

Any deployment of EnzoVezzaro mcp-dominican-layer that includes the parse-pdf component prior to the commit 39dd373786712650097ad31db27d5c477c8f9c82 is at risk. No specific version numbers are listed, so all versions up to and including that commit are affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, with no EPSS value available and the CVE not listed in the CISA Known Exploited Vulnerabilities catalog. Nonetheless, the public nature of the exploit and the ability to initiate the attack remotely mean that the risk remains real. The most likely attack vector is a web or API request that passes a user-supplied PDF URL to the vulnerable function.

Generated by OpenCVE AI on August 14, 2026 at 00:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of mcp-dominican-layer that eliminates the vulnerable parse-pdf function or includes proper input validation.
  • Apply network segmentation or firewall rules to restrict outbound connections from the service, allowing only connections to approved domains.
  • Use a web application firewall to detect and block suspicious requests to the parse-pdf endpoint that contain potentially malicious pdfUrl values.
  • Review the source code and implement whitelist-based validation for pdfUrl so that only permitted domains are accessed.

Generated by OpenCVE AI on August 14, 2026 at 00:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Title EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery
First Time appeared Enzovezzaro
Enzovezzaro mcp-dominican-layer
Weaknesses CWE-918
CPEs cpe:2.3:a:enzovezzaro:mcp-dominican-layer:*:*:*:*:*:*:*:*
Vendors & Products Enzovezzaro
Enzovezzaro mcp-dominican-layer
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Enzovezzaro Mcp-dominican-layer
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-14T15:03:28.224Z

Reserved: 2026-08-13T14:58:26.032Z

Link: CVE-2026-19752

cve-icon Vulnrichment

Updated: 2026-08-14T15:03:02.743Z

cve-icon NVD

Status : Deferred

Published: 2026-08-13T22:17:19.663

Modified: 2026-08-14T19:09:39.140

Link: CVE-2026-19752

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T09:30:06Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)