Summarize before version 0.17.0 is vulnerable to a server‑side request forgery that allows an attacker who controls a podcast RSS feed to supply malicious podcast:transcript URLs pointing to loopback, link‑local, RFC 1918, or other reserved addresses. DNS rebinding and redirect‑based techniques can bypass the application’s protections because redirect targets are not revalidated and hostnames are not resolved before the request is dispatched, causing internal service responses to be exposed through the summarization flow.

The vulnerability affects the steipete Summarize product. All releases prior to 0.17.0 are vulnerable.

The CVSS score is 6.3. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious podcast feed; the attacker can then instruct the host to fetch data from internal or restricted addresses, potentially exposing sensitive data or internal network services. The risk level is moderate to high, with a clear path to internal resource disclosure.