CVE-2026-45244

The record

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.

Affected packages

Related vulnerabilities

• GHSA-67gq-6q8c-qqh6 Summarize contains a missing authorization vulnerability Same vulnerability
• GHSA-2r69-qgv3-hr65 Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover… Also affects @steipete/summarize
• GHSA-5624-2pmv-jx46 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
• GHSA-8jr4-6r33-phwm Summarize contains a path traversal vulnerability Also affects @steipete/summarize
• CVE-2026-45245 Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that… Also affects @steipete/summarize
• CVE-2026-45242 Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize… Also affects @steipete/summarize
• CVE-2026-45243 Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content… Also affects @steipete/summarize
• GHSA-qp7v-gjgg-4mj6 @steipete/summarize allows local attackers to read bearer tokens and API credentials… Also affects @steipete/summarize