CVE-2025-46553
Medium
Description
@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn't enforced. Misskey will follow redirects, despite explicitly requesting not to. Version 5.2.1 contains a patch for the issue.
SeverityMedium
CVSS6.1
Exploit probability18. percentile0.3%
Product
Misskey Summaly
PublishedMay 5, 2025
First seenMay 5, 2025
How to fix
Update
- misskey summaly5.2.1 or later
- @misskey-dev/summaly5.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| misskey summaly | 3.0.1 ≤ v < 5.2.1 | 5.2.1 |
| @misskey-dev/summalynpm | 3.0.1 ≤ v < 5.2.1 | 5.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.