CVE-2026-53782 json
Summarize < 0.17.0 SSRF via podcast:transcript URL fetch
published 2026-06-11 4 mo ago modified 2026-11-08 23 h ago also EUVD-2026-36308 , GHSA-3vx2-vqx8-jxfg
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 17%
- public exploits
- 0
- none known
Summary
Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values. Attackers can bypass protections through DNS rebinding and redirect-based techniques, as redirect targets are not revalidated and hostnames are not resolved before request dispatch, exposing internal service responses through the summarization flow.
Patch / fix
- npm @steipete/summarize 0.17.0
- steipete summarize 0.17.0
- github.com/steipete/summarize@3c55224 commit
- github.com/steipete/summarize#239 pull request
- github.com/steipete/summarize/releases/tag/v0.17.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 17% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @steipete/summarize | <0.17.0 |
0.17.0 |
Affected products
- steipete summarize
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/steipete/summarize/pull/239
issue-tracking, patch, web
-
github.com
/steipete/summarize/commit/3c5522440c4833dde033e226baa39e6dda1dfc75
patch, web
-
github.com
/steipete/summarize/releases/tag/v0.17.0
release-notes, web
-
vulncheck.com
/advisories/summarize-ssrf-via-podcast-transcript-url-fetch
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-53782
advisory
-
github.com
/steipete/summarize
package
Sources
- CVE List CVE-2026-53782
- GitHub Advisory GHSA-3vx2-vqx8-jxfg
- NVD CVE-2026-53782
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.