Firecrawl vulnerabilities

2 known vulnerabilities in Firecrawl from Firecrawl. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  firecrawl: Improper Neutralization of Special Elements used in a Command

  CVE-2026-72904Aug 10, 2026Firecrawl

  Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in apps/a

• 8.6 High severity

  Firecrawl: Server-Side Request Forgery

  CVE-2026-32857Mar 26, 2026Firecrawl

  Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network policy validation is applied only to the initial user-supplied URL and not to subsequent redirect de