CVE-2026-19751

Name of the Vulnerable Software and Affected Versions EnzoVezzaro mcp-dominican-layer versions up to 39dd373786712650097ad31db27d5c477c8f9c82

Description A flaw in the parse-csv tool component allows remote attackers to perform server-side request forgery (SSRF), a technique where an attacker induces a server-side application to make requests to an unintended location. The issue exists within the axios.get() function located in the src/index.ts file, specifically through the manipulation of the csvUrl argument.

Recommendations As a temporary workaround, restrict the use of the csvUrl argument in the axios.get() function within the parse-csv tool to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.