Homepage

@steipete/summarize-core@0.12.0

Summarize core library (content extraction + prompts).

  • latest version

    0.21.11

  • latest non vulnerable version

    0.21.11

  • first published

    7 months ago

  • latest version published

    7 days ago

  • View summarize-core package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @steipete/summarize-core package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Allocation of Resources Without Limits or Throttling

    @steipete/summarize-core is a Summarize core library (content extraction + prompts).

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the temp-file download process. An attacker can exhaust disk or system resources by streaming an unbounded media response to local storage when the response bypasses the enforced size limit due to missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade @steipete/summarize-core to version 0.17.0 or higher.

    <0.17.0
    • M
    Server-side Request Forgery (SSRF)

    @steipete/summarize-core is a Summarize core library (content extraction + prompts).

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the podcast:transcript URL handling process. An attacker can access internal network resources or sensitive information by supplying a malicious URL in a podcast RSS feed, which causes the server to fetch content from restricted or private addresses. Attackers may leverage DNS rebinding or redirect-based techniques to bypass protections, as redirect targets are not revalidated and hostnames are not resolved before dispatching requests.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade @steipete/summarize-core to version 0.17.0 or higher.

    <0.17.0
    Go back to all versions of this package