Executive brief
The @steipete/summarize tool, used for processing and summarizing media like podcasts, is vulnerable to a resource exhaustion attack. An attacker can provide a specially crafted media link that bypasses file size limits, causing the software to fill up the host's disk space. This can lead to system crashes or service outages on the machine running the tool.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in @steipete/summarize-core before version 0.17.0. The application fails to properly enforce size limits on media downloads when encountering missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests. A remote attacker controlling a podcast feed or media URL can stream an unbounded response to local storage via the temporary file download path. This allows for a Denial of Service (DoS) by exhausting disk or system resources on the host running the CLI. The issue is fixed in version 0.17.0.
Affected products
- steipete @steipete/summarize-core < 0.17.0
Timeline
- 2026-06-11: disclosed
- 2026-06-11: advisory
- 2026-07-27: patched: Advisory updated with patch details