CVE-2026-53782 json
Summarize < 0.17.0 SSRF via podcast:transcript URL fetch
published 5mo ago modified 3d ago also EUVD-2026-36308 , GHSA-3vx2-vqx8-jxfg
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values. Attackers can bypass protections through DNS rebinding and redirect-based techniques, as redirect targets are not revalidated and hostnames are not resolved before request dispatch, exposing internal service responses through the summarization flow.
Patch / fix
- npm @steipete/summarize 0.17.0
- steipete summarize 0.17.0
- github.com/steipete/summarize@3c55224 commit
- github.com/steipete/summarize#239 pull request
- github.com/steipete/summarize/releases/tag/v0.17.0 release
Is CVE-2026-53782 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @steipete/summarize | <0.17.0 |
0.17.0 |
Affected products
- steipete summarize
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/steipete/summarize/pull/239
issue-tracking, patch, web
-
github.com
/steipete/summarize/commit/3c5522440c4833dde033e226baa39e6dda1dfc75
patch, web
-
github.com
/steipete/summarize/releases/tag/v0.17.0
release-notes, web
-
vulncheck.com
/advisories/summarize-ssrf-via-podcast-transcript-url-fetch
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-53782
advisory
-
github.com
/steipete/summarize
package
Sources
- CVE List CVE-2026-53782
- GitHub Advisory GHSA-3vx2-vqx8-jxfg
- NVD CVE-2026-53782
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.