CVE-2026-72904: Firecrawl's JSON Schema Parser Leaks Server Files Through $ref Expansion
Firecrawl versions before 2.11.32 let authenticated attackers read arbitrary files and perform SSRF via unsafe JSON schema $ref dereferencing. The extraction pipeline follows file and HTTP references without restriction.
Contents
TL;DR: Firecrawl versions before 2.11.32 let an authenticated attacker read arbitrary files from the server and probe internal network services. The bug lives in the JSON schema dereferencing pipeline, where user-supplied $ref pointers in default, const, or enum fields get resolved against the local filesystem. Fix it by upgrading to 2.11.32.
What Firecrawl is
Firecrawl converts entire websites into clean markdown or structured JSON for large language model pipelines. Developers point it at a URL, and it crawls the site, strips boilerplate, and returns LLM-ready text or structured data matching a user-defined JSON schema. The project has accumulated over 20,000 GitHub stars and runs as a self-hosted service or through Firecrawl's hosted API. Studios and engineering teams use it to build RAG pipelines, competitive analysis tools, and automated content ingestion workflows.
The extraction feature is where this vulnerability lives. When a user submits a custom JSON schema describing the structure they want Firecrawl to return, the schema gets processed through a dereferencing step. That step follows $ref pointers to resolve references within the schema.
The vulnerability
The dereferencing code in apps/api/src/lib/extract/helpers/dereference-schema.ts calls the json-schema-ref-parser library with default resolver settings. Default settings allow external and local file references to be resolved during schema processing. That means a $ref pointing at file:///etc/passwd or an internal HTTP endpoint gets followed without restriction.
The attack works because AJV validation, which runs after dereferencing, does not traverse default, const, or enum fields. An attacker plants a malicious $ref inside one of those fields. The schema parser tries to resolve the reference, hits the local filesystem or an internal URL, and fails. The error message, which includes the file contents or HTTP response, gets persisted and returned through the extraction API.
This gives an authenticated attacker two capabilities: arbitrary file reads from the extract worker's filesystem, and server-side request forgery against internal or external HTTP endpoints. Both are reachable through a single crafted schema payload.
Who is affected
Anyone running Firecrawl self-hosted at a version prior to 2.11.32. The affected package is firecrawl/firecrawl. Self-hosted deployments are the primary concern because the extract worker has direct filesystem access to the host. Hosted Firecrawl instances were patched at the same time, but users who pinned older container images or Docker tags need to update.
Authentication is required. The attacker needs a valid API key or session to submit an extraction request. In multi-tenant self-hosted setups, any tenant with API access can exploit this against the shared worker.
What to do
Upgrade to Firecrawl 2.11.32 or later. The fix restricts the json-schema-ref-parser resolver to disallow external and local file references during schema processing.
If you are running Firecrawl in Docker, pull the latest image:
docker pull ghcr.io/mendableai/firecrawl:latest
docker compose up -dIf you installed via npm:
npm install [email protected]Until you can upgrade, disable the extraction endpoint or restrict schema processing to trusted users only. Network-level controls (egress filtering on the extract worker) limit SSRF blast radius but do not prevent local file reads.
Why it matters
Firecrawl sits at a trust boundary: it accepts user-defined schemas and processes them on a server with filesystem and network access. This CVE turns an extraction API into a file-read and SSRF primitive with a single HTTP request. For self-hosted deployments on cloud infrastructure, file reads can expose cloud credentials in /proc/self/environ or mounted secret volumes. SSRF can reach cloud metadata endpoints at 169.254.169.254.
NVD enrichment is pending. No CVSS score has been assigned yet through official channels, but the impact profile (authenticated file read + SSRF on a popular AI tooling component) warrants urgent patching for any self-hosted deployment.
References
Continue reading
All posts
CVE-2026-72603: wg-easy WireGuard UI Lets Low-Privilege Users Execute Root Commands
wg-easy 15.3.0 has an OS command injection vulnerability in its client creation flow. Users with clients.create permission can inject WireGuard PostUp directives via newlines in the client name field, achieving root code execution.
CVE-2026-72533: Portainer CE Authentication Bypass Grants Root Access to Docker Hosts
Portainer CE through 2.44.0 has an authentication bypass in its Docker proxy endpoint. Low-privileged users can craft non-canonical URL paths to bypass authorization checks and gain root-level access to the Docker host.
CVE-2026-58231: Unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter
SAP Commerce Cloud Data Hub Adapter ships with a default authentication client. An unauthenticated attacker can submit crafted input to validation-lacking functions, achieving arbitrary code execution. No fix available yet.