Before version 0.17.0, the summarize CLI has a resource exhaustion flaw that enables remote attackers to exhaust disk space on the host running the tool. By providing a media URL that either lacks a Content-Length header, is served with chunked transfer encoding, or results in a failed HEAD request, the downloader can stream an unbounded file to the local temporary file path. This unbounded write flow burns the host’s available storage, leading to a denial‑of‑service state. The vulnerability does not directly expose confidential data, but it can render the system unusable.

The steipete summarize project, versions prior to 0.17.0, including all releases before the 0.17.0 tag. No other vendors or products are listed as affected.

The CVSS score of 5.3 classifies the weakness as moderate severity. EPSS information is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV. Attackers must control a podcast feed or media URL that the CLI consumes, a role that is typically remote. Once a malicious media source is provided, the exploit can occur without authentication and can exhaust disk resources on any system running the vulnerable CLI, potentially affecting single‑user or system‑wide availability. Proper exploitation therefore requires that the attacker can supply the media source; once that condition is met, the risk is considerable.