Firecrawl
Monthly
Arbitrary local file read in firecrawl-mcp-server 3.20.2 allows any caller of the firecrawl_parse MCP tool to extract sensitive host files - including credentials, SSH keys, and environment variables - by supplying absolute paths or directory traversal sequences as the unconstrained filePath argument. Retrieved file contents are uploaded and injected directly into the AI model's context window, making this both a direct exfiltration risk and a prompt-injection amplifier. No CISA KEV listing or public exploit code has been identified at time of analysis, but the attack mechanics are trivially reproducible from the GitHub issue report and the CVSS 4.0 score of 8.7 makes this an urgent remediation target.
Arbitrary file read and SSRF in Firecrawl before 2.11.32 lets an API caller exfiltrate files from the extraction worker and reach internal/external HTTP endpoints by abusing JSON-schema dereferencing. The extract feature passes user-supplied schemas to the json-schema-ref-parser library with default resolvers, so a $ref placed inside default, const, or enum fields (which AJV does not traverse) is resolved against the local filesystem or network; a deliberately triggered dereference error then leaks the resolved file contents back through the extraction API's persisted error message. No public exploit or CISA KEV listing is identified at time of analysis, but the fix commit ships security regression tests demonstrating the file:// and metadata-endpoint attack paths.
Firecrawl's Playwright scraping service through version 2.8.0 permits attackers to bypass SSRF protections and access internal network resources by exploiting a validation gap in redirect handling. Unauthenticated remote attackers can supply externally valid URLs that redirect to restricted internal endpoints, as network policy checks apply only to the initial request and not subsequent redirect destinations. With a CVSS score of 7.8 and high subsequent system confidentiality impact (SC:H), this represents a distinct post-redirect enforcement weakness separate from general redirect-based SSRF (CVE-2024-56800), though no public exploit is identified at time of analysis.
Arbitrary local file read in firecrawl-mcp-server 3.20.2 allows any caller of the firecrawl_parse MCP tool to extract sensitive host files - including credentials, SSH keys, and environment variables - by supplying absolute paths or directory traversal sequences as the unconstrained filePath argument. Retrieved file contents are uploaded and injected directly into the AI model's context window, making this both a direct exfiltration risk and a prompt-injection amplifier. No CISA KEV listing or public exploit code has been identified at time of analysis, but the attack mechanics are trivially reproducible from the GitHub issue report and the CVSS 4.0 score of 8.7 makes this an urgent remediation target.
Arbitrary file read and SSRF in Firecrawl before 2.11.32 lets an API caller exfiltrate files from the extraction worker and reach internal/external HTTP endpoints by abusing JSON-schema dereferencing. The extract feature passes user-supplied schemas to the json-schema-ref-parser library with default resolvers, so a $ref placed inside default, const, or enum fields (which AJV does not traverse) is resolved against the local filesystem or network; a deliberately triggered dereference error then leaks the resolved file contents back through the extraction API's persisted error message. No public exploit or CISA KEV listing is identified at time of analysis, but the fix commit ships security regression tests demonstrating the file:// and metadata-endpoint attack paths.
Firecrawl's Playwright scraping service through version 2.8.0 permits attackers to bypass SSRF protections and access internal network resources by exploiting a validation gap in redirect handling. Unauthenticated remote attackers can supply externally valid URLs that redirect to restricted internal endpoints, as network policy checks apply only to the initial request and not subsequent redirect destinations. With a CVSS score of 7.8 and high subsequent system confidentiality impact (SC:H), this represents a distinct post-redirect enforcement weakness separate from general redirect-based SSRF (CVE-2024-56800), though no public exploit is identified at time of analysis.