CVE-2026-45242

The record

Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction.

Affected packages

Related vulnerabilities

• GHSA-8jr4-6r33-phwm Summarize contains a path traversal vulnerability Same vulnerability
• GHSA-2r69-qgv3-hr65 Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover… Also affects @steipete/summarize
• GHSA-67gq-6q8c-qqh6 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
• GHSA-5624-2pmv-jx46 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
• CVE-2026-45244 Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows… Also affects @steipete/summarize
• CVE-2026-45245 Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that… Also affects @steipete/summarize
• CVE-2026-45243 Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content… Also affects @steipete/summarize
• GHSA-qp7v-gjgg-4mj6 @steipete/summarize allows local attackers to read bearer tokens and API credentials… Also affects @steipete/summarize