Firecrawl

5 CVEs in 2 Firecrawl products, including Firecrawl, Firecrawl-Mcp-Server. Newest: CVE-2026-116066 (2026-10-25).

Firecrawl products with known CVEs

ProductCVEs
Firecrawl4
Firecrawl-Mcp-Server1
Firecrawl CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-116066Medium6.82026-10-25Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalH…
CVE-2026-85606High7.52026-09-04firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments witho…
CVE-2026-729042026-08-10Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl'…
CVE-2026-32857High8.62026-03-26Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network…
CVE-2025-57818Medium6.32025-08-26Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery (SSRF) vulnerability was disc…