CVE-2026-53782 Summarize < 0.17.0 SSRF via podcast:transcript URL fetch
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-53782?
CVE-2026-53782 is a medium-severity vulnerability in steipete summarize, published on 11 Jun 2026.
Official description
Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values. Attackers can bypass protections through DNS rebinding and redirect-based techniques, as redirect targets are not revalidated and hostnames are not resolved before request dispatch, exposing internal service responses through the summarization flow.
Weakness: CWE-918
Which versions are affected by CVE-2026-53782?
2 open source packages ship an affected version, including @steipete/summarize.
| Package | Affected | Fixed in |
|---|---|---|
@steipete/summarize npm | All versions | 0.17.0 |
@steipete/summarize npm | All versions | 0.17.0 |
How do I fix CVE-2026-53782?
Upgrade @steipete/summarize to 0.17.0 or later.
Is CVE-2026-53782 being exploited?
There is no known exploitation of CVE-2026-53782 in the wild and no public exploit code.
Sources
Also known as GHSA-3vx2-vqx8-jxfg.