EUVD-2026-58545
GHSA-j229-cr78-6mf5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring low-privilege tool invocation; no scope change; limited C/I/A impact consistent with SSRF without direct code execution.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-Side Request Forgery in EnzoVezzaro's mcp-dominican-layer MCP server allows an authenticated remote attacker to coerce the server into issuing arbitrary HTTP requests via the parse-csv tool's unsanitized csvUrl parameter. The vulnerability exists in the axios.get call within src/index.ts and has been confirmed exploitable with a publicly available proof-of-concept. The CVSS 4.0 score of 2.1 reflects the low confidentiality, integrity, and availability impact, but SSRF primitives can be chained to probe internal services or cloud metadata endpoints depending on the deployment context.
Technical ContextAI
The affected component is the parse-csv tool implemented in src/index.ts of EnzoVezzaro/mcp-dominican-layer, a Model Context Protocol (MCP) server providing Dominican-locale data utilities. The root cause is CWE-918 (Server-Side Request Forgery): the axios.get() function is invoked with the user-supplied csvUrl argument without URL validation, allowlisting, or scheme restriction. This allows the attacker to specify arbitrary URLs - including internal RFC-1918 addresses, loopback interfaces, cloud metadata endpoints (e.g. 169.254.169.254), or file:// schemes depending on axios configuration. The vulnerability is scoped to network-reachable instances of this MCP server where a caller can invoke the parse-csv tool.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project was notified via the GitHub issue at https://github.com/EnzoVezzaro/mcp-dominican-layer/issues/2 but has not responded. The upstream fix has not been committed as of the affected commit hash (39dd373). As a compensating control, operators should restrict which MCP tool callers can invoke the parse-csv tool by enforcing MCP-level authentication and authorization policies. Network-level egress filtering on the host running mcp-dominican-layer should be applied to block requests to internal RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and cloud metadata addresses (169.254.169.254) - note this does not fix the vulnerability but limits the SSRF blast radius. If the parse-csv tool is not needed, disabling or removing it from the MCP server configuration eliminates the attack surface entirely with no functional side effects for other tools. Organizations in cloud environments should additionally ensure instance metadata service requires IMDSv2 (AWS) or equivalent protections to prevent metadata credential theft via SSRF.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today