EnzoVezzaro mcp-dominican-layer contains a server-side request forgery vulnerability in the PDF Parsing component's parse-pdf function. By manipulating the pdfUrl argument, an attacker can cause the server to send crafted requests to arbitrary URLs. This vulnerability affects all versions up to the specified commit 39dd373786712650097ad31db27d5c477c8f9c82. The vulnerability is remotely exploitable without user interaction and has been publicly disclosed. No official fix or remediation has been provided by the vendor as of the publication date.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server to internal or external systems. This may lead to information disclosure, unauthorized access to internal resources, or interaction with otherwise inaccessible services. The CVSS score of 5.3 reflects a medium impact with low complexity and no privileges required, but limited scope and impact on confidentiality, integrity, and availability.

No official patch or remediation has been released by the vendor. Users should monitor the vendor's advisories for updates. Until a fix is available, avoid exposing the vulnerable parse-pdf functionality to untrusted input or restrict network access from the server to sensitive internal resources to reduce potential impact.