Technical impact
Firecrawl before version 2.11.586 has a server‑side request forgery condition where attackers can persuade the Playwright service to fetch data from an internal IP address that is not part of the internal network checks. By manipulating the DNS resolution of the target domain, the attacker can first provide a DNS response that passes the public‑host check and then, during the actual connection, supply a private‑address resolution that the application will follow. This allows the attacker to read cloud metadata, internal services, or any data accessible from the host on which the Playwright service runs. The vulnerability is classified as CWE‑918, which is exploitation of a server‑side request forgery flaw.
Affected Systems
Firecrawl’s Playwright service running any release before 2.11.586 is impacted. Users of the Firecrawl product that expose the security‑critical SSRF proxy to external requests should consider their installation a risk until the software is updated to the fixed version or later.
Risk and Exploitability
The CVSS score of 7.0 marks the vulnerability as high severity and indicates a significant risk to confidentiality, integrity, and availability. Exclusion from the CISA KEV catalog and the lack of an EPSS value mean there is no current evidence of broader exploitation, yet the technique—DNS rebinding—is well known and could be leveraged by a remote attacker who can control the DNS record for the scrape target. The vulnerability can be exploited without authentication if the Playwright service endpoint is reachable from the attacker’s network, and the only pre‑condition is the attacker’s ability to influence the DNS resolution process. This leads to a low attack‑cost, high impact vector for a malicious actor with network control over the scrape target.
