GHSA-qp7v-gjgg-4mj6
Medium · 6.1CVSS
6.1
EPSS
—
Published
May 11, 2026
CISA due date
—
The record
@steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @steipete/summarize | 0 | 0.15.0 |
Related vulnerabilities
- CVE-2026-45222 Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon… Same vulnerability
- GHSA-2r69-qgv3-hr65 Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover… Also affects @steipete/summarize
- GHSA-67gq-6q8c-qqh6 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
- GHSA-5624-2pmv-jx46 Summarize contains a missing authorization vulnerability Also affects @steipete/summarize
- GHSA-8jr4-6r33-phwm Summarize contains a path traversal vulnerability Also affects @steipete/summarize
- CVE-2026-45244 Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows… Also affects @steipete/summarize
- CVE-2026-45245 Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that… Also affects @steipete/summarize
- CVE-2026-45242 Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize… Also affects @steipete/summarize