CVE-2026-45222
1 advisory.
npm/@steipete/summarize CVE-2026-45222: medium 6.1, EPSS 0.14%
@steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json
Action: Upgrade @steipete/summarize to 0.15.0 or later.
npm i @steipete/summarize@0.15.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.15.0 | - |
Fixed versions
| 0.15.0 |
Sources
- osv: GHSA-qp7v-gjgg-4mj6
- https://nvd.nist.gov/vuln/detail/CVE-2026-45222
- https://github.com/steipete/summarize/pull/214
- https://github.com/steipete/summarize/commit/0cfb0fb99777a87a7b02082b5e4bd449f8dd6175
- https://github.com/steipete/summarize
- https://github.com/steipete/summarize/releases/tag/v0.15.0
- https://www.vulncheck.com/advisories/summarize-insecure-daemon-configuration-file-permissions
CVE-2026-45222 · published · modified · JSON