CVE-2026-53782

Name of the Vulnerable Software and Affected Versions Summarize versions prior to 0.17.0

Description An issue exists where attackers controlling a podcast RSS feed can perform Server-Side Request Forgery (SSRF), a flaw that allows a server to be coerced into making unintended requests. By providing malicious podcast:transcript URL values, attackers can direct the host to fetch content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations. Protections can be bypassed using DNS rebinding and redirect-based techniques because redirect targets are not revalidated and hostnames are not resolved before the request is dispatched, which exposes internal service responses through the summarization flow.

Recommendations Update to version 0.17.0 or later.