The vulnerability permits an attacker to bypass Firecrawl’s SSRF protection in the Playwright scraping service. By supplying a URL that passes initial validation but redirects to an internal target, the service follows the redirect and fetches data from a privileged resource. This can expose confidential internal endpoints or services, enabling an attacker to read or manipulate data without authentication. The issue is a classic Server‑Side Request Forgery (CWE‑918).

Firecrawl versions 2.8.0 and earlier are affected. All deployments that use the Playwright scraping service are potentially at risk, regardless of operating environment. Operators should check the package/version in use and plan an update as soon as a patch is released.

The CVSS base score is 7.8, signifying a high‑severity flaw. No publicly available exploit statistics are reported, and the vulnerability is not yet catalogued in major exploit databases, indicating it is still emerging. An unauthenticated attacker can trigger the flaw by sending a crafted request to the public Playwright endpoint; the server’s missing post‑redirect validation allows the request to reach any internal network address reachable from the scraper, potentially giving the attacker direct access to protected services.