Arbitrary file read via JSON Schema $ref expansion in Firecrawl (CVE-2026-72904)

Firecrawl's extraction functionality unsafely dereferences user-supplied JSON schemas using @apidevtools/json-schema-ref-parser with default resolver settings, allowing local file and remote URL references to be resolved. An authenticated attacker can embed malicious $ref values in schema fields not validated by AJV (such as default, const, or enum), causing dereference errors that expose file contents in persisted API error messages. Successful exploitation may enable arbitrary file reads, exfiltration of environment variables and secrets, and server-side request forgery against internal or external endpoints. Affected versions: - < 2.11.32 We recommend updating to: 2.11.32. CVSS 9.3 · our assessment: act_now Reference: https://github.com/firecrawl/firecrawl/security/advisories/GHSA-3p54-jg6f-68r8 Details: https://vuln.today/cve/CVE-2026-72904