{"id":"CVE-2025-46553","aliases":["GHSA-7899-w6c4-vqc4"],"url":"https://o3.security/vulnerability/CVE-2025-46553","summary":"@misskey-dev/summaly Redirect Filter Bypass","details":"### Summary\nA logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn't enforced.\n\n### Details\nIn the main `summaly` function, a new `scrapingOptions` object is created and passed to either the matched plugin, if any, or the default summarize function. The issue here is that the new `scrapingOptions` object is not provided the `allowRedirects` property of `opts`.\n\n### PoC\n- Publish a post containing a link to any URL that redirects on Misskey.\n- A preview will be generated for the target of the redirect, despite Misskey passing `allowRedirects: false`.\n\n### Impact\nMisskey will follow redirects, despite explicitly requesting not to.","published":"2025-05-05T18:28:50.216Z","modified":"2026-08-12T03:51:24.873963541Z","cvss":null,"epss":{"score":0.00249,"percentile":0.16416,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@misskey-dev/summaly","fixedVersion":"5.2.1"}],"fix":{"url":"https://github.com/misskey-dev/summaly/commit/45153b4f08a772c395a13f7a25399dd87ed022ed","label":"misskey-dev/summaly@45153b4"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46553.json"},{"type":"ADVISORY","url":"https://github.com/misskey-dev/summaly/security/advisories/GHSA-7899-w6c4-vqc4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46553"},{"type":"FIX","url":"https://github.com/misskey-dev/summaly/commit/45153b4f08a772c395a13f7a25399dd87ed022ed"},{"type":"PACKAGE","url":"https://github.com/misskey-dev/summaly"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:24.873963541Z"}}