| Package | Affected versions | Patched versions |
|---|---|---|
| summaly | ≥ 3.0.1, < 5.2.1 | 5.2.1 |
| @misskey-dev/summaly | ≥ 3.0.1, < 5.2.1 | 5.2.1 |
A logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced.
In the main summaly function, a new scrapingOptions object is created and passed to either the matched plugin, if any, or the default summarize function. The issue here is that the new scrapingOptions object is not provided the allowRedirects property of opts.
allowRedirects: false.Misskey will follow redirects, despite explicitly requesting not to.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free