EUVD-2026-58517
GHSA-w8xr-v3ff-6585
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SSRF requires low-privilege endpoint access (PR:L per CVSS 4.0 source); scope unchanged as no subsequent system impact is evidenced; no availability impact from request forgery alone.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in EnzoVezzaro's mcp-dominican-layer MCP server (all versions through commit 39dd373786712650097ad31db27d5c477c8f9c82) allows low-privileged remote attackers to manipulate the pdfUrl argument within the parse-pdf function, causing the server to issue arbitrary outbound HTTP requests to internal or external resources under attacker control. A public proof-of-concept has been disclosed via the GitHub issue tracker, lowering the exploitation bar, though the CVSS 4.0 base score of 2.1 reflects constrained impact. The project maintainer has not responded to the responsible disclosure issue filed on GitHub, and no vendor patch exists at time of analysis.
Technical ContextAI
The vulnerability resides in the parse-pdf function within src/index.ts of mcp-dominican-layer, a Model Context Protocol (MCP) server implementation designed to expose Dominican-locale services to LLM-based toolchains. CWE-918 (Server-Side Request Forgery) describes the root cause: user-supplied input - in this case the pdfUrl parameter - is used to construct server-side HTTP requests without adequate URL validation or allowlisting. This allows the server to be weaponized as an HTTP proxy, potentially reaching RFC 1918 private addresses, cloud instance metadata endpoints such as 169.254.169.254, or internal APIs inaccessible directly to the attacker. MCP servers act as middleware between LLM orchestration layers and backend services, meaning SSRF vulnerabilities in this class of software can expose sensitive internal infrastructure depending on the server's network placement. No CPE identifiers have been assigned in the available intelligence data.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer had not responded to the responsible disclosure issue (https://github.com/EnzoVezzaro/mcp-dominican-layer/issues/3) as of the report date. Operators building from source should apply input validation in src/index.ts to restrict the pdfUrl parameter to an explicit allowlist of trusted domains or URL schemes, rejecting private IP ranges and loopback addresses at the application layer. As a network-level compensating control, deploying outbound egress firewall rules on the host running mcp-dominican-layer to block requests to RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the link-local metadata address (169.254.169.254) will substantially reduce SSRF blast radius, though it does not eliminate the flaw. Additionally, restricting which low-privileged principals can invoke the parse-pdf endpoint reduces the attack surface. Monitor VulDB entry https://vuldb.com/vuln/389530 for patch availability updates.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today