TI-2026-38777 Aliases CVE-2026-53781 GHSA-q9xm-f36c-xm3q

Summarize < 0.17.0 Disk Exhaustion via Uncapped Media Download

LOW 24CWE-770Published 2026-06-11 · Updated 2026-11-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced size limit through missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests. Attackers who control a podcast feed or media URL can stream an unbounded response to local storage via the temp-file download path, exhausting disk or system resources on the host running the CLI.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00324 25th percentileScored 2026-11-07

Fix Fixed summarize (steipete): 0.17.0@steipete/summarize-core (npm): 0.17.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
steipete	summarize	before 0.17.0	0.17.0	Patch available	CNA
—	@steipete/summarize-core (npm)	before 0.17.0	0.17.0	Patch available	GHSA-q9xm-f36c-xm3q

summarize Vendorsteipete Affected before 0.17.0 Fixed in 0.17.0 Patch available CNA
@steipete/summarize-core (npm) Vendor— Affected before 0.17.0 Fixed in 0.17.0 Patch available GHSA-q9xm-f36c-xm3q

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:steipete:summarize::::::::	—	—	steipete

cpe:2.3:a:steipete:summarize:*:*:*:*:*:*:*:* Versions — — ·steipete

Remediation

Fix · CNA summarize (steipete) Fixed in 0.17.0
Fix · GHSA-q9xm-f36c-xm3q @steipete/summarize-core (npm) Fixed in 0.17.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-11
steipete summarize 0.17.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-38778 Summarize < 0.17.0 SSRF via podcast:transcript URL fetchPriority LOW 28
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-53781
2026-10-03 Alias added: GHSA-q9xm-f36c-xm3q

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-53781

Other 2

TI-2026-36349 CodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp File CVSS 4.0HIGH 7.5
TI-2026-36350 CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow CVSS 4.0HIGH 7.2
TI-2026-33049 Summarize < 0.15.1 Path Traversal via slidesDir Parameter CVSS 4.0HIGH 7.1
TI-2026-33037 Summarize Insecure Daemon Configuration File Permissions CVSS 4.0MEDIUM 6.9
TI-2026-33052 Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events CVSS 4.0MEDIUM 4.6
TI-2026-31730 CodexBar < 0.32.0 Session Cookie Exposure via HTTP Redirect CVSS 4.0HIGH 8.2

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences