CVE-2026-45243

The record

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.

Affected packages

Related vulnerabilities

• GHSA-5624-2pmv-jx46 Summarize contains a missing authorization vulnerability Same vulnerability
• GHSA-2r69-qgv3-hr65 Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover… Also affects @steipete/summarize
• GHSA-67gq-6q8c-qqh6 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
• GHSA-8jr4-6r33-phwm Summarize contains a path traversal vulnerability Also affects @steipete/summarize
• CVE-2026-45244 Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows… Also affects @steipete/summarize
• CVE-2026-45245 Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that… Also affects @steipete/summarize
• CVE-2026-45242 Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize… Also affects @steipete/summarize
• GHSA-qp7v-gjgg-4mj6 @steipete/summarize allows local attackers to read bearer tokens and API credentials… Also affects @steipete/summarize