CVE-2026-19752 in mcp-dominican-layer
Summary
by MITRE • 08/14/2026
A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability resides within the EnzoVezzaro mcp-dominican-layer repository where a server-side request forgery flaw exists in the PDF parsing functionality. The specific weakness manifests in the parse-pdf function located in src/index.ts, which processes pdfUrl arguments without adequate validation or sanitization. This allows malicious actors to manipulate the pdfUrl parameter to initiate unauthorized requests to arbitrary servers, potentially enabling data exfiltration or internal network reconnaissance. The vulnerability affects versions up to commit 39dd373786712650097ad31db27d5c477c8f9c82 and represents a critical security risk due to its remote exploitability.
The technical implementation of this flaw stems from insufficient input validation within the PDF parsing component, creating an attack surface where user-supplied URLs can be directly processed without proper sanitization measures. This vulnerability aligns with CWE-918, which specifically addresses server-side request forgery vulnerabilities that occur when applications fail to properly validate or sanitize external inputs used in HTTP requests. The flaw permits attackers to bypass normal access controls and potentially access internal systems or services that would otherwise be protected by network segmentation. When an attacker crafts a malicious pdfUrl parameter, the application processes it without verification, leading to unintended server behavior.
The operational impact of this vulnerability extends beyond simple data theft, as it can enable attackers to perform various malicious activities including internal port scanning, service enumeration, and potentially unauthorized access to backend systems. The exploit being publicly available increases the risk profile significantly, as it removes the requirement for advanced technical skills typically needed to discover such vulnerabilities. Organizations relying on this component could face severe consequences including data breaches, system compromise, and regulatory compliance violations. The vulnerability's remote exploitability means that attackers can initiate attacks from anywhere on the internet without requiring physical access or special privileges.
Mitigation strategies should focus on implementing robust input validation and sanitization for all external URL parameters within the PDF parsing functionality. The recommended approach includes establishing a whitelist of allowed domains, implementing strict URL format validation, and employing proper encoding techniques to prevent malicious input from being processed. Organizations should also consider implementing network-level protections such as firewalls and proxy configurations that restrict outbound connections from the application server. Additionally, regular security audits and dependency updates are crucial to address similar vulnerabilities in third-party components. The issue was reported early through an official channel but remains unaddressed by the project maintainers, highlighting the importance of proactive vulnerability management and timely patch deployment according to established security protocols.