CVE-2025-46553 - CVE House

Back to Database

Status published Low CVE-2025-46553

@misskey-dev/summaly Redirect Filter Bypass

2.1 CVSS

Vulnerability Description

@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn't enforced. Misskey will follow redirects, despite explicitly requesting not to. Version 5.2.1 contains a patch for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-46553

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from misskey-dev

View All →

Misskey has a login rate limit bypass via spoofed X-Forwarded-For header

misskey.js's export data contains private post data

Misskey Directory Traversal Vulnerability in AiScript via `Mk:api`

Misskey CSS Style Injection Vulnerability In `MkUrlPreview`

Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

Affected Vendor

misskey-dev

View all reports →

Affected Software

summaly

Vulnerable Versions:

>= 3.0.1, < 5.2.1

Timeline

Official Publish: May 5th, 2025

Last Modified: May 5th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-693 CWE-601 CWE-665 CWE-669

MITRE ATT&CK TTPs

T1562 Impair Defenses

Defense Evasion

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1550 Use Alternate Authentication Material

Defense Evasion

T1485 Data Destruction

T1204 User Execution

T1071 Application Layer Protocol

Command and Control

T1189 Drive-by Compromise

T1036 Masquerading

Defense Evasion