CVE-2025-46553: @misskey dev/summaly @misskey-dev/summaly Redirect Filter Bypass Vulnerability

LOW
Advisory Identifier: GHSA-7899-w6c4-vqc4
Share
CWE-669 CWE-693 CWE-601 CWE-665
Published
Advisory Summary

CVE-2025-46553 is a LOW @misskey-dev/summaly redirect filter bypass vulnerability (CWE-669: Incorrect Resource Transfer Between Spheres) affecting @misskey dev/summaly libraries in the npm ecosystem. The issue involves @misskey-dev/summaly redirect filter bypass. Remediation is available by upgrading affected packages to version 5.2.1.

CVE-2025-46553 at a Glance

CVE Identifier CVE-2025-46553
GHSA Identifier GHSA-7899-w6c4-vqc4
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification CWE-669: Incorrect Resource Transfer Between Spheres
Affected Product @misskey dev/summaly
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2025-46553

To remediate this vulnerability, upgrade all affected @misskey dev/summaly dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@misskey-dev/summaly fixed: 5.2.1 
npm install @misskey-dev/summaly@5.2.1
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls @misskey-dev/summaly

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2025-46553, inspect your project dependencies using npm:

npm ls @misskey-dev/summaly

Analyze the terminal output to locate any version of @misskey dev/summaly in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.2.1), your application is affected.

Note: The npm ls @misskey-dev/summaly command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-669: Incorrect Resource Transfer Between Spheres, where the product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource. In @misskey dev/summaly, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary A logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn't enforced. ### Details In the main `summaly` function, a new `scrapingOptions` object is created and passed to either the matched plugin, if any, or the default summarize function. The issue here is that the new `scrapingOptions` object is not provided the `allowRedirects` property of `opts`. ### PoC - Publish a post containing a link to any URL that redirects on Misskey. - A preview will be generated for the target of the redirect, despite Misskey passing `allowRedirects: false`. ### Impact Misskey will follow redirects, despite explicitly requesting not to.

CVE-2025-46553 Affected @misskey dev/summaly Versions

1 component(s)
Fixed Versions:
5.2.1
Product / Package Ecosystem Affected Versions Fixed Version
@misskey-dev/summaly
npm/@misskey-dev/summaly
npm
≥ 3.0.1
< 5.2.1
5.2.1

References

GitHub Advisory / Wiki ADVISORY
https://github.com/misskey-dev/summaly/security/advisories/GHSA-7899-w6c4-vqc4
NVD — CVE-2025-46553 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-46553
Security Fix Commit FIX COMMIT
https://github.com/misskey-dev/summaly/commit/45153b4f08a772c395a13f7a25399dd87ed022ed
@misskey dev/summaly Source Repository REPOSITORY
https://github.com/misskey-dev/summaly

Frequently Asked Questions

What is CVE-2025-46553?
CVE-2025-46553 is a security vulnerability in @misskey dev/summaly involving @misskey-dev/summaly Redirect Filter Bypass under CWE-669: Incorrect Resource Transfer Between Spheres.
Which @misskey dev/summaly versions are affected?
Affected versions include releases prior to 5.2.1 across affected packages: @misskey-dev/summaly.
What version fixes CVE-2025-46553?
Upgrading to 5.2.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @misskey-dev/summaly affected?
Yes, @misskey-dev/summaly is affected in releases prior to 5.2.1. Upgrade your dependency to 5.2.1 or later.
What CWE is associated with CVE-2025-46553?
CVE-2025-46553 is classified under CWE-669: Incorrect Resource Transfer Between Spheres (The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.).
How can I check npm dependencies for CVE-2025-46553?
Run the dependency tree command: 'npm ls @misskey-dev/summaly'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7899-w6c4-vqc4",
  "modified" : "2025-05-05T22:06:39Z",
  "published" : "2025-05-05T17:03:20Z",
  "aliases" : [ "CVE-2025-46553" ],
  "summary" : "@misskey-dev/summaly Redirect Filter Bypass",
  "details" : "### Summary\nA logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn't enforced.\n\n### Details\nIn the main `summaly` function, a new `scrapingOptions` object is created and passed to either the matched plugin, if any, or the default summarize function. The issue here is that the new `scrapingOptions` object is not provided the `allowRedirects` property of `opts`.\n\n### PoC\n- Publish a post containing a link to any URL that redirects on Misskey.\n- A preview will be generated for the target of the redirect, despite Misskey passing `allowRedirects: false`.\n\n### Impact\nMisskey will follow redirects, despite explicitly requesting not to.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@misskey-dev/summaly"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.1"
      }, {
        "fixed" : "5.2.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/misskey-dev/summaly/security/advisories/GHSA-7899-w6c4-vqc4"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-46553"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/misskey-dev/summaly/commit/45153b4f08a772c395a13f7a25399dd87ed022ed"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/misskey-dev/summaly"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-601", "CWE-665", "CWE-669", "CWE-693" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-05-05T17:03:20Z",
    "nvd_published_at" : "2025-05-05T19:15:56Z"
  }
}