CVE-2026-45242
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A path traversal vulnerability in Summarize prior to 0.15.1 allows authenticated attackers to write files to arbitrary directories via the slidesDir parameter in the /v1/summarize endpoint. Attackers can exploit this to write slide_*.png and slides.json files and subsequently delete matching files through repeated extraction.
Risk Assessment
The organization is at risk of unauthorized file write and deletion, potentially leading to data integrity compromise, loss of configuration files, or further attack escalation.
Recommendation
Immediately upgrade Summarize to version 0.15.1 or later, which includes a fix for the path traversal vulnerability.
Other vulnerabilities in Summarize
See all- CVE-2026-53782High
Summarize before version 0.17.0 contains a server-side request forgery (SSRF) vulnerability. Attackers controlling a podcast RSS feed can direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values.
- CVE-2026-53781Medium
A resource exhaustion vulnerability in Summarize before version 0.17.0 allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced size limit through missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests. Attackers who control a podcast feed or media URL can stream an unbounded response to local storage via the temp-file download path, exhausting disk or system resources on the host running the CLI.
- CVE-2026-45246Medium
A vulnerability in Summarize prior to 0.15.1 involves insecure file permissions in the refresh-free configuration rewrite path. This causes the configuration file containing API keys and provider credentials to be created with default process umask permissions instead of preserving the original permissions, allowing local users to read sensitive data.
- CVE-2026-45245High
A vulnerability in the Summarize extension prior to version 0.15.1 allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness.
- CVE-2026-45244Medium
Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.
- CVE-2026-45243Medium
A missing authorization vulnerability in Summarize prior to 0.15.1 in the content script window.postMessage bridge allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.
- CVE-2026-45222Medium
The vulnerability in Summarize versions through 0.14.1 (fixed in commit 0cfb0fb) creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json.
Original NVD description (English source)
Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction.