Loading story…
Firecrawl disclosed and fixed CVE-2026-72904, a critical vulnerability in its extraction functionality that allowed arbitrary file read and server-side request forgery through unsafe JSON Schema $ref dereferencing. In versions prior to 2.11.32, the application used @apidevtools/json-schema-ref-parser with default resolver behavior, enabling attacker-supplied schemas to resolve local file paths and remote HTTP(S) references. Attackers could hide $ref values inside default, const, or enum fields that AJV would not traverse, then force a dereference error so contents from the extract worker filesystem were exposed in API error messages.
The fix replaces the external schema dereferencing library with an internal dereferenceSchema implementation that only expands internal JSON Pointer references within the same document. The new logic preserves unresolved or external references, blocks filesystem and HTTP(S) resolution to prevent file access and SSRF, detects self-referential cycles, and enforces a maximum resolution limit of 50,000 to prevent runaway processing. Tests added with the patch explicitly verify that file-based and network-based $ref values remain untouched, and the hardened resolver was integrated into Firecrawl’s schema-processing path.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The vulnerability CVE-2026-72904 was published as a critical issue affecting Firecrawl versions before 2.11.32, describing arbitrary file read and SSRF via unsafe JSON Schema $ref expansion in the extraction functionality. The advisory states the issue is fixed in version 2.11.32 and references GitHub advisory GHSA-3p54-jg6f-68r8.
A Firecrawl code change replaced @apidevtools/json-schema-ref-parser with an internal dereferenceSchema helper that only resolves internal JSON Pointer references and leaves file and HTTP(S) $ref values untouched. The change was integrated into the extraction path and added tests to prevent filesystem reads and SSRF during schema processing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity server-side request forgery flaw tracked as **CVE-2026-54690** affects `datamodel-code-generator` when it processes attacker-controlled JSON Schema `$ref` values pointing to `http` or `https` URLs. In vulnerable releases, the tool silently resolves remote references during schema processing, allowing outbound requests to arbitrary destinations; one report places the affected range at **0.9.1 through 0.60.x**, while another indicates exposure through **0.61.0**. The issue has a **CVSS v3.1 score of 8.2** and is tied to schema resolution and HTTP fetch logic in files including `jsonschema.py` and `http.py`. Researchers said the vulnerable code passes untrusted URLs directly to the HTTP client, follows redirects, and does not adequately restrict hostnames, ports, or IP ranges, creating a path to reach internal services such as `127.0.0.1` and cloud metadata endpoints like `169.254.169.254`. Fetched content may also be incorporated into generated output, raising information disclosure risk in addition to SSRF. The issue is fixed in **version 0.61.0**, with the patch adding URL validation and blocking localhost-style and non-global IP targets unless private-network access is explicitly enabled; recommended mitigations include disabling remote reference resolution or blocking private-network access.
Jul 29, 2026
CrewAI disclosed and patched **CVE-2026-62240**, a high-severity server-side request forgery flaw in versions prior to `1.15.1` that affected scrape and URL-fetching features. The bug stemmed from `validate_url` performing a single hostname resolution and blocklist check before returning the original URL, while downstream `requests.get` calls could still follow attacker-controlled redirects to internal destinations. Reported impact included access to loopback addresses, RFC1918 space, and cloud metadata endpoints such as `169.254.169.254`, creating a path to secret and credential exfiltration. The fix was shipped in **CrewAI `1.15.1`** and implemented earlier in a GitHub patch that replaced direct fetches with a new `safe_get` helper across multiple loaders and website-scraping tools. The updated logic validates every redirect target, limits redirect chains, blocks redirects to internal resources, and strips sensitive headers and cookies on cross-origin redirects; accompanying tests verify that direct internal URLs and redirected internal URLs are denied while safe relative redirects remain allowed. Organizations using affected CrewAI releases are advised to upgrade to `1.15.1` or later and review any application flows that ingest external URLs.
Jul 14, 2026
Crawl4AI disclosed critical vulnerabilities in its Docker API server affecting versions `0.8.6` and earlier, including an AST sandbox escape in the computed fields feature that allowed **unauthenticated remote code execution** through the `/crawl` endpoint. The flaw let attackers abuse Python generator and frame attributes such as `gi_frame`, `f_back`, and `f_builtins` to reach `__import__` and run arbitrary OS commands inside the container. Additional reported weaknesses in the network-exposed API included unsafe code execution controls, server-side request forgery, missing authentication protections, hardcoded credentials, and improper path sanitization affecting endpoints including `/screenshot`, `/pdf`, `/crawl`, and `/execute_js`. The project patched the issues in version `0.8.7` by removing `eval()` from the computed-field execution path, replacing the prior underscore-based attribute blocklist with a stricter allowlist, tightening `_safe_eval_config`, and removing dangerous built-ins from the hook manager. The update also added path validation to stop traversal-style file writes and introduced adversarial security tests covering the reported exploit chains. Maintainers advised users to upgrade immediately, enable JWT authentication with `CRAWL4AI_API_TOKEN`, configure secrets securely, restrict network exposure of the Docker API, and disable JavaScript execution where it is not required.
Jun 29, 2026