CVE-2025-46553: @misskey-dev/summaly Redirect Filter Bypass
@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced. Misskey will follow redirects, despite explicitly requesting not to. Version 5.2.1 contains a patch for the issue.
Other sources
Summary A logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced.
Details In the main summaly function, a new scrapingOptions object is created and passed to either the matched plugin, if any, or the default summarize function. The issue here is that the new scrapingOptions object is not provided the allowRedirects property of opts.
PoC - Publish a post containing a link to any URL that redirects on Misskey. - A preview will be generated for the target of the redirect, despite Misskey passing allowRedirects: false.
Impact Misskey will follow redirects, despite explicitly requesting not to.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46553?
The severity of CVE-2025-46553 is considered moderate due to the potential for improper redirection handling.
How do I fix CVE-2025-46553?
To fix CVE-2025-46553, upgrade the @misskey-dev/summaly package to version 5.2.1 or later.
What is affected by CVE-2025-46553?
CVE-2025-46553 affects @misskey-dev/summaly versions between 3.0.1 and 5.2.0.
What is the root cause of CVE-2025-46553?
The root cause of CVE-2025-46553 is a logic error in the main summaly function that prevents the allowRedirects option from being passed to plugins.
Is there a workaround for CVE-2025-46553?
Currently, the only effective workaround for CVE-2025-46553 is to upgrade to the patched version 5.2.1.