CVE-2026-45222

The record

Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json. A local attacker can exploit these permissive permissions to read the daemon bearer token and persisted provider credentials, enabling unauthorized access to the daemon or recovery of sensitive API keys.

Affected packages

Related vulnerabilities

• GHSA-qp7v-gjgg-4mj6 @steipete/summarize allows local attackers to read bearer tokens and API credentials… Same vulnerability
• GHSA-2r69-qgv3-hr65 Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover… Also affects @steipete/summarize
• GHSA-67gq-6q8c-qqh6 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
• GHSA-5624-2pmv-jx46 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
• GHSA-8jr4-6r33-phwm Summarize contains a path traversal vulnerability Also affects @steipete/summarize
• CVE-2026-45244 Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows… Also affects @steipete/summarize
• CVE-2026-45245 Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that… Also affects @steipete/summarize
• CVE-2026-45242 Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize… Also affects @steipete/summarize