{"id":"EUVD-2026-36308","enisaUuid":"63a40e2d-f384-3ac5-9cbd-90e869ed760a","description":"Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values. Attackers can bypass protections through DNS rebinding and redirect-based techniques, as redirect targets are not revalidated and hostnames are not resolved before request dispatch, exposing internal service responses through the summarization flow.","datePublished":"Jun 11, 2026, 7:17:19 PM","dateUpdated":"Oct 8, 2026, 3:23:11 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/steipete/summarize/releases/tag/v0.17.0\nhttps://github.com/steipete/summarize/pull/239\nhttps://github.com/steipete/summarize/commit/3c5522440c4833dde033e226baa39e6dda1dfc75\nhttps://www.vulncheck.com/advisories/summarize-ssrf-via-podcast-transcript-url-fetch\n","aliases":"CVE-2026-53782\nGHSA-3vx2-vqx8-jxfg\n","assigner":"VulnCheck","epss":0.26,"enisaIdProduct":[{"id":"a429b20d-bd3c-3382-a6e3-45940db07d1f","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"0 \u003c0.17.0"}],"enisaIdVendor":[{"id":"e2482204-094b-3589-b556-22cd3cb962c5","vendor":{"name":"steipete"}}],"enisaIdVulnerability":[{"id":"3b494049-51f4-3712-ab96-8c0a4358adb8","vulnerability":{"id":"GHSA-3vx2-vqx8-jxfg","description":"@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch","datePublished":"Jun 11, 2026, 9:31:57 PM","dateUpdated":"Aug 20, 2026, 6:33:58 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-53782\nhttps://github.com/steipete/summarize/pull/239\nhttps://github.com/steipete/summarize/commit/3c5522440c4833dde033e226baa39e6dda1dfc75\nhttps://github.com/steipete/summarize\nhttps://github.com/steipete/summarize/releases/tag/v0.17.0\nhttps://www.vulncheck.com/advisories/summarize-ssrf-via-podcast-transcript-url-fetch\n","enisa_id":"EUVD-2026-36308\n","aliases":"GHSA-3vx2-vqx8-jxfg\nCVE-2026-53782\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"5087932b-9b32-314b-a293-36cc8f3c6a59","vulnerability":{"id":"CVE-2026-53782","description":"Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values. Attackers can bypass protections through DNS rebinding and redirect-based techniques, as redirect targets are not revalidated and hostnames are not resolved before request dispatch, exposing internal service responses through the summarization flow.","datePublished":"Jun 11, 2026, 7:17:19 PM","dateUpdated":"Oct 8, 2026, 3:23:11 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/steipete/summarize/releases/tag/v0.17.0\nhttps://github.com/steipete/summarize/pull/239\nhttps://github.com/steipete/summarize/commit/3c5522440c4833dde033e226baa39e6dda1dfc75\nhttps://www.vulncheck.com/advisories/summarize-ssrf-via-podcast-transcript-url-fetch\n","enisa_id":"EUVD-2026-36308\n","assigner":"VulnCheck","epss":0.26,"dataProcessed":"Oct 30, 2026, 7:16:47 AM","vulnerabilityProduct":[{"id":"1f80e39c-d4f5-3329-9a95-00d57d268a8b","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"0 \u003c0.17.0"}],"vulnerabilityVendor":[{"id":"cd552a99-4721-3757-a56a-a80fda98c52b","vendor":{"name":"steipete"}}]}}],"enisaIdAdvisory":[]}