The EnzoVezzaro mcp-dominican-layer component contains a server-side request forgery vulnerability in its PDF parsing functionality. Specifically, the parse-pdf function in src/index.ts improperly handles the pdfUrl argument, allowing an attacker to cause the server to make arbitrary HTTP requests. This vulnerability is remotely exploitable and affects all versions up to the specified commit 39dd373786712650097ad31db27d5c477c8f9c82. Although the vulnerability was reported early, the vendor has not issued a patch or official remediation. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server to internal or external systems. This may lead to information disclosure or interaction with internal services not otherwise accessible. However, the CVSS score and vector indicate limited impact due to low privileges required and limited scope and confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing network-level restrictions to limit outbound requests from the affected component as a temporary mitigation. Monitor for updates from the vendor for an official fix.