Is CVE-2026-53781 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53781 being exploited in the wild.

How severe is CVE-2026-53781?

Medium severity, with a CVSS score of 4.3, published 11 June 2026.

Which products and versions are affected?

@steipete/summarize-core (npm) < 0.17.0, SEMVER:introduced=0,fixed=0.17.0; Steipete Summarize < 0.17.0; Steipete Summarize-Core < 0.17.0.

Is there a fix for CVE-2026-53781?

Yes. @steipete/summarize-core (npm): upgrade to 0.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53781 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53781?

Check whether you run @steipete/summarize-core (npm), Steipete Summarize or Steipete Summarize-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53781: steipete summarize disk exhaustion via uncapped media download

Q: Is there a fix for CVE-2026-53781?

Yes. @steipete/summarize-core (npm): upgrade to 0.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-53781 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-53781?

Check whether you run @steipete/summarize-core (npm), Steipete Summarize or Steipete Summarize-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53781 · Severity: medium · CVSS 4.3 · Published 2026-06-11

The @steipete/summarize tool, used for processing and summarizing media like podcasts, is vulnerable to a resource exhaustion attack. An attacker can provide a specially crafted media link that bypasses file size limits, causing the software to fill up the host's disk space. This can lead to system crashes or service outages on the machine running the tool.

Technologies: Steipete Summarize. Vendors: npm, Steipete.

Quick answers

Is CVE-2026-53781 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53781 being exploited in the wild.
How severe is CVE-2026-53781?: Medium severity, with a CVSS score of 4.3, published 11 June 2026.
Which products and versions are affected?: @steipete/summarize-core (npm) < 0.17.0, SEMVER:introduced=0,fixed=0.17.0; Steipete Summarize < 0.17.0; Steipete Summarize-Core < 0.17.0.
Is there a fix for CVE-2026-53781?: Yes. @steipete/summarize-core (npm): upgrade to 0.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53781 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53781?: Check whether you run @steipete/summarize-core (npm), Steipete Summarize or Steipete Summarize-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@steipete/summarize-core (npm): upgrade to 0.17.0 or later
```
npm install @steipete/summarize-core@0.17.0
```

Technical details

A resource exhaustion vulnerability (CWE-770) exists in @steipete/summarize-core before version 0.17.0. The application fails to properly enforce size limits on media downloads when encountering missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests. A remote attacker controlling a podcast feed or media URL can stream an unbounded response to local storage via the temporary file download path. This allows for a Denial of Service (DoS) by exhausting disk or system resources on the host running the CLI. The issue is fixed in version 0.17.0.

Affected products

steipete @steipete/summarize-core < 0.17.0

Identifiers

CVE-2026-53781
GHSA-q9xm-f36c-xm3q

Timeline

2026-06-11: disclosed
2026-06-11: advisory
2026-07-27: patched: Advisory updated with patch details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.