Firecrawl Mcp Server
Monthly
Arbitrary local file read in firecrawl-mcp-server 3.20.2 allows any caller of the firecrawl_parse MCP tool to extract sensitive host files - including credentials, SSH keys, and environment variables - by supplying absolute paths or directory traversal sequences as the unconstrained filePath argument. Retrieved file contents are uploaded and injected directly into the AI model's context window, making this both a direct exfiltration risk and a prompt-injection amplifier. No CISA KEV listing or public exploit code has been identified at time of analysis, but the attack mechanics are trivially reproducible from the GitHub issue report and the CVSS 4.0 score of 8.7 makes this an urgent remediation target.
Arbitrary local file read in firecrawl-mcp-server 3.20.2 allows any caller of the firecrawl_parse MCP tool to extract sensitive host files - including credentials, SSH keys, and environment variables - by supplying absolute paths or directory traversal sequences as the unconstrained filePath argument. Retrieved file contents are uploaded and injected directly into the AI model's context window, making this both a direct exfiltration risk and a prompt-injection amplifier. No CISA KEV listing or public exploit code has been identified at time of analysis, but the attack mechanics are trivially reproducible from the GitHub issue report and the CVSS 4.0 score of 8.7 makes this an urgent remediation target.