Summarize CLI CVE-2026-53781

The victim must run the Summarize CLI and direct it at an attacker-controlled podcast feed or media URL - the attacker must control the origin server serving the media response. The attacker's server must serve a response that bypasses size enforcement via one or more of: (1) omitting or falsifying the Content-Length header, (2) using HTTP chunked transfer encoding, or (3) deliberately failing the HEAD request pre-check that the CLI uses for size estimation. Exploitation is limited to disk and system resource availability on the host running the CLI; there is no confidentiality or integrity impact. In interactive use, UI:P applies - the user must choose to process the malicious feed. In automated pipeline deployments that process third-party feeds without human review, the user-interaction barrier is effectively absent. No attacker-side authentication or privileges are required.

The provided CVSS 4.0 score of 5.3 reflects a medium-severity finding. The attack vector is network (AV:N) with low complexity (AC:L) and no attacker privileges required (PR:N), but user interaction is required (UI:P) - the victim must actively run the CLI against an attacker-controlled resource. Impact is limited to low availability loss on the vulnerable system (VA:L) with no confidentiality or integrity consequences. There is no CISA KEV listing and no public POC, making large-scale opportunistic exploitation unlikely. The realistic threat model is a targeted or social-engineering scenario where an attacker directs a victim to a malicious feed. For organizations running Summarize in automated pipelines against third-party feeds, however, the UI:P barrier is effectively nullified, meaningfully elevating practical risk. The absence of EPSS data prevents quantitative comparison, but the combination of no KEV and no POC supports treating this as a routine patch-cycle priority rather than an emergency.

An attacker registers a malicious podcast feed and publishes episode entries whose media URLs point to an attacker-controlled server. When a victim runs the Summarize CLI against this feed, the server responds to media download requests with HTTP chunked transfer encoding and no Content-Length header, causing the HEAD-based size pre-check to fail or return a falsified small value. The CLI streams the response to a temp file without a fallback byte counter, filling the host's available disk and causing the local system or co-hosted services to fail due to storage exhaustion.