CVE-2026-53781
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A resource exhaustion vulnerability in Summarize before version 0.17.0 allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced size limit through missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests. Attackers who control a podcast feed or media URL can stream an unbounded response to local storage via the temp-file download path, exhausting disk or system resources on the host running the CLI.
Risk Assessment
The organization risks disk space or system resource exhaustion, potentially leading to denial of service (DoS) and data loss on the server or workstation running the CLI tool.
Recommendation
Immediately update Summarize to version 0.17.0 or later, which includes a fix for this vulnerability. Until updated, restrict access to untrusted podcast feeds and media URLs.
Other vulnerabilities in Summarize
See all- CVE-2026-53782High
Summarize before version 0.17.0 contains a server-side request forgery (SSRF) vulnerability. Attackers controlling a podcast RSS feed can direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values.
- CVE-2026-45246Medium
A vulnerability in Summarize prior to 0.15.1 involves insecure file permissions in the refresh-free configuration rewrite path. This causes the configuration file containing API keys and provider credentials to be created with default process umask permissions instead of preserving the original permissions, allowing local users to read sensitive data.
- CVE-2026-45245High
A vulnerability in the Summarize extension prior to version 0.15.1 allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness.
- CVE-2026-45244Medium
Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.
- CVE-2026-45243Medium
A missing authorization vulnerability in Summarize prior to 0.15.1 in the content script window.postMessage bridge allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.
- CVE-2026-45242High
A path traversal vulnerability in Summarize prior to 0.15.1 allows authenticated attackers to write files to arbitrary directories via the slidesDir parameter in the /v1/summarize endpoint. Attackers can exploit this to write slide_*.png and slides.json files and subsequently delete matching files through repeated extraction.
- CVE-2026-45222Medium
The vulnerability in Summarize versions through 0.14.1 (fixed in commit 0cfb0fb) creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json.
Original NVD description (English source)
Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced size limit through missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests. Attackers who control a podcast feed or media URL can stream an unbounded response to local storage via the temp-file download path, exhausting disk or system resources on the host running the CLI.