@misskey-dev/summaly Redirect Filter Bypass
Summary
A logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced.
Details
In the main summaly function, a new scrapingOptions object is created and passed to either the matched plugin, if any, or the default summarize function. The issue here is that the new scrapingOptions object is not provided the allowRedirects property of opts.
PoC
- Publish a post containing a link to any URL that redirects on Misskey.
- A preview will be generated for the target of the redirect, despite Misskey passing
allowRedirects: false.
Impact
Misskey will follow redirects, despite explicitly requesting not to.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @misskey-dev/summaly | >= 3.0.1, < 5.2.1 | 5.2.1 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:P- Weakness (CWE)
CWE-601, CWE-665, CWE-669, CWE-693- Platform
- npm
- Package
@misskey-dev/summaly- Disclosed
- 05.05.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-7899-w6c4-vqc4 - CC BY 4.0
Vulnerability history: @misskey-dev/summaly
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 05.2025 05.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 1
- Low 1
Disclosures per year
- 2025: 2
- 2026: 0
-
@misskey-dev/summaly Redirect Filter Bypass this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.