CVE-2026-53782
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Summarize before version 0.17.0 contains a server-side request forgery (SSRF) vulnerability. Attackers controlling a podcast RSS feed can direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values.
Risk Assessment
The risk involves potential exposure of internal service responses through the summarization flow. Attackers can bypass protections via DNS rebinding and redirect-based techniques, as redirect targets are not revalidated and hostnames are not resolved before request dispatch.
Recommendation
Immediately update Summarize to version 0.17.0 or later, which includes a fix for the SSRF vulnerability. Additionally, consider restricting access to internal network resources for processes involved in transcript fetching.
Original NVD description (English source)
Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values. Attackers can bypass protections through DNS rebinding and redirect-based techniques, as redirect targets are not revalidated and hostnames are not resolved before request dispatch, exposing internal service responses through the summarization flow.