Loading vulnerability…
Arbitrary File Read and SSRF in Firecrawl Extraction Schema Dereferencing
CVE-2026-72904 is a critical vulnerability in Firecrawl versions prior to 2.11.32 affecting the extraction functionality. The flaw is caused by unsafe dereferencing of user-supplied JSON Schema content in the schema handling logic within the extraction pipeline. Firecrawl invokes a JSON Schema reference parser with default resolver behavior, which permits resolution of both local file references and external network references during schema processing. An attacker can craft a malicious schema containing a $ref embedded in fields such as default, const, or enum that are not traversed by AJV validation, allowing the reference to reach the dereferencing stage unchecked. By causing a dereference error, the attacker can induce the application to persist error messages that include referenced content, which is then returned through the extraction API. This can expose contents from the extract worker filesystem and can also force outbound requests to internal or external HTTP endpoints.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose arbitrary files accessible to the extract worker, potentially exposing application secrets, configuration data, credentials, tokens, or other sensitive local resources. The same flaw can also be used for server-side request forgery, allowing an attacker to induce requests to internal or external services reachable from the vulnerable environment. Because referenced content may be reflected in persisted error messages returned by the API, exploitation can provide direct access to sensitive data and internal network-reachable resources.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict or disable the extraction feature for untrusted users, especially where user-controlled JSON schemas are accepted. Prevent schema dereferencers from resolving local file and remote references, or enforce an allowlist of permitted reference targets. Limit filesystem access available to extract workers, segment internal network access to reduce SSRF impact, and sanitize API error responses so referenced content is not exposed to clients.
Patch, then assume compromise.
Upgrade Firecrawl to version 2.11.32 or later, which fixes the unsafe schema dereferencing behavior. Review the extraction functionality and any custom schema-processing logic to ensure external and local reference resolution is disabled or tightly restricted for untrusted schemas. Validate and sanitize user-supplied JSON schemas before dereferencing, and ensure error handling does not persist or return sensitive referenced content to clients.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.