GHSA-2r69-qgv3-hr65
High · 7.4CVSS
7.4
EPSS
—
Published
May 18, 2026
CISA due date
—
The record
Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @steipete/summarize | 0 | 0.15.1 |
Related vulnerabilities
- CVE-2026-45245 Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that… Same vulnerability
- GHSA-67gq-6q8c-qqh6 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
- GHSA-5624-2pmv-jx46 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
- GHSA-8jr4-6r33-phwm Summarize contains a path traversal vulnerability Also affects @steipete/summarize
- CVE-2026-45244 Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows… Also affects @steipete/summarize
- CVE-2026-45242 Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize… Also affects @steipete/summarize
- CVE-2026-45243 Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content… Also affects @steipete/summarize
- GHSA-qp7v-gjgg-4mj6 @steipete/summarize allows local attackers to read bearer tokens and API credentials… Also affects @steipete/summarize