Vulnerability · Published Aug 13, 2026 · Assigned by VulDB

CVE-2026-19752EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery

Medium 6.3

In plain English

A medium-severity server-side request forgery in mcp-dominican-layer from EnzoVezzaro. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 69.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
EnzoVezzaro	mcp-dominican-layer	39dd373786712650097ad31db27d5c477c8f9c82

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-389530 | EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery vdb-entry, technical-description
VDB-389530 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-19752 | CVE Analysis and Report third-party-advisory
Submit #868928 | EnzoVezzaro mcp-dominican-layer Latest Server-Side Request Forgery third-party-advisory
https://github.com/EnzoVezzaro/mcp-dominican-layer/issues/3 exploit, issue-tracking
https://github.com/EnzoVezzaro/mcp-dominican-layer/ product