CVE-2026-45245

The record

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.

Affected packages

Related vulnerabilities

• GHSA-2r69-qgv3-hr65 Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover… Same vulnerability
• GHSA-67gq-6q8c-qqh6 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
• GHSA-5624-2pmv-jx46 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
• GHSA-8jr4-6r33-phwm Summarize contains a path traversal vulnerability Also affects @steipete/summarize
• CVE-2026-45244 Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows… Also affects @steipete/summarize
• CVE-2026-45242 Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize… Also affects @steipete/summarize
• CVE-2026-45243 Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content… Also affects @steipete/summarize
• GHSA-qp7v-gjgg-4mj6 @steipete/summarize allows local attackers to read bearer tokens and API credentials… Also affects @steipete/summarize