firecrawl-mcp-server version 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool. The tool accepts unconstrained filePath arguments without any directory containment or path validation logic. Attackers can supply absolute paths or directory traversal sequences (e.g., ../../) to read sensitive files on the host system. Sensitive data such as credentials, API keys, and environment variables can be exfiltrated. The read file contents are then uploaded and returned to the model context, making this particularly dangerous in AI/MCP pipeline deployments. The vulnerability was fixed in version 3.24.1 as evidenced by the patched source code in the linked GitHub reference. This represents a supply chain risk for any application or AI agent leveraging the firecrawl-mcp-server package. Users should upgrade immediately to a patched version and restrict file system access as a mitigation.
