CVE-2026-19751

CVE-2026-19751 is an SSRF in the npm package 'mcp-dominican-layer', specifically its 'parse-csv tool' which calls axios.get on a csvUrl parameter without any input validation. This is not a surprising vulnerability — it's the natural consequence of a package whose entire purpose is fetching URLs from arbitrary sources, written without security boundary awareness, in an ecosystem where npm's low-friction publish model incentivizes exactly this pattern. The critical question for defenders is not whether the package fetches URLs — it does, that's the documented function. The question is whether the package validates what it fetches against private IP ranges, rejects file:// schemes, or imposes any boundary on destination targets. It doesn't. The commit that introduced axios.get without sanitization is the bug, and the absence of any subsequent fix is the ongoing exposure. What makes this case unusual is the MCP (Model Context Protocol) integration context. This package is explicitly designed to receive input from AI agents, not human operators. That changes the attacker model entirely. Traditional SSRF assumes a human operator or trusted application passing URLs; MCP tools receive URLs synthesized by language models operating on natural-language instructions. An attacker doesn't need to exploit the package directly — they need to convince the AI agent that fetching an internal endpoint is a plausible subtask. The security boundary has shifted from 'does this package validate URLs' to 'does this AI orchestrator constrain what the agent can request.' The low EPSS score for this CVE reflects scoring on the package in isolation, not the composite risk when embedded in an MCP pipeline. A CSV fetcher used by a human analyst is low-risk. The same fetcher called by an LLM with access to internal systems is high-risk. The institutional tendency to apply server-boundary logic to utility-boundary vulnerabilities produces lower severity scores for exactly these cases, which then justifies consumer inaction, which keeps vulnerable code in dependency trees longer. For consumers: verify whether any system in your environment passes AI-generated URLs to this package without its own validation layer. The package's unmaintained status means the vulnerability will not be patched upstream — your defensive controls must exist at the integration point, not the dependency. Consider whether MCP tools that synthesize URLs from natural-language prompts create acceptable risk when paired with a package that performs no URL validation. If the answer is no, remove the dependency or wrap it with a validation proxy that enforces private IP range blocks and rejects non-HTTP(S) schemes.

Reviewed through automated stages and approved by a human before publication.