Vulnerabilities

TI-2026-80146 CVE-2026-116066 · GHSA-xmmq-vp8j-m5qf

DNS rebinding bypasses SSRF checks in Firecrawl Playwright service

MEDIUM 64

Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding.

CVSS 4.0HIGH 7.0 Network No auth No interaction EPSS 0.00277 Published 2026-10-25 Fixed in 2.11.586 CWE-918

TI-2026-58731 CVE-2026-85606 · GHSA-q267-2jg6-m7vc

firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath

MEDIUM 45

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00897 Published 2026-09-04 No fix listed CWE-22

TI-2026-51121 CVE-2026-72904

Firecrawl: Arbitrary file read via JSON Schema $ref expansion

MEDIUM 48

Firecrawl turns entire websites into LLM-ready markdown or structured data.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00461 Published 2026-08-10 Fixed in 2.11.32 CWE-77

TI-2026-25319 CVE-2026-32857 · GHSA-9j9r-wghq-j565

Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation

MEDIUM 40

Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network policy validation is applied only to the initial user-suppli…

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.00422 Published 2026-03-26 No fix listed CWE-918

TI-2025-35701 CVE-2025-57818

Firecrawl SSRF Vulnerability via malicious webhook

LOW 28