Skip to content
OpenAdvisories

Vendor

firecrawl

5 known vulnerabilities.

firecrawl at a glance

Last 12 months
4
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability, 1 critical September 2026: 1 vulnerability Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202610
Aug 202611
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202610
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202510
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

firecrawl 4 firecrawl-mcp-server 1
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Medium 6.8
    CVE-2026-116066

    Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service

    Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public addr…

    firecrawl firecrawl
  • High 7.5
    CVE-2026-85606

    firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath

    firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequ…

    firecrawl firecrawl-mcp-server
  • Critical 9.3
    CVE-2026-72904

    Firecrawl: Arbitrary file read via JSON Schema $ref expansion

    Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in apps/…

    firecrawl firecrawl
  • High 8.6
    CVE-2026-32857

    Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation

    Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network policy validation is applied only to the initial user-supplied URL and not to subsequent redirect d…

    firecrawl firecrawl
  • Medium 6.3
    CVE-2025-57818

    Firecrawl SSRF Vulnerability via malicious webhook

    Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an int…

    firecrawl firecrawl