Read the docs
TI-2026-33037 Aliases CVE-2026-45222GHSA-qp7v-gjgg-4mj6

Summarize Insecure Daemon Configuration File Permissions

Priority MEDIUM 64CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json. A local attacker can exploit these permissive permissions to read the daemon bearer token and persisted provider credentials, enabling unauthorized access to the daemon or recovery of sensitive API keys.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00148 4th percentileScored 2026-11-07
Fix Fixed @steipete/summarize (npm): 0.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
steipetesummarizeup to 0.14.1—Patch availableCNA
—@steipete/summarize (npm)before 0.15.00.15.0Patch availableGHSA-qp7v-gjgg-4mj6
  • summarize Vendorsteipete Affected up to 0.14.1 Fixed in — Patch available CNA
  • @steipete/summarize (npm) Vendor— Affected before 0.15.0 Fixed in 0.15.0 Patch available GHSA-qp7v-gjgg-4mj6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:steipete:summarize:*:*:*:*:*:*:*:*——steipete
  • cpe:2.3:a:steipete:summarize:*:*:*:*:*:*:*:* Versions — — ·steipete

Remediation

  • Fix · GHSA-qp7v-gjgg-4mj6 @steipete/summarize (npm) Fixed in 0.15.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45222
  2. 2026-10-03 Alias added: GHSA-qp7v-gjgg-4mj6

References

Patch 2

Advisory 1

Other 2

  • TI-2026-36349 CodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp File CVSS 4.0HIGH 7.5
  • TI-2026-36350 CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow CVSS 4.0HIGH 7.2
  • TI-2026-33049 Summarize < 0.15.1 Path Traversal via slidesDir Parameter CVSS 4.0HIGH 7.1
  • TI-2026-33052 Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events CVSS 4.0MEDIUM 4.6
  • TI-2026-31730 CodexBar < 0.32.0 Session Cookie Exposure via HTTP Redirect CVSS 4.0HIGH 8.2
  • TI-2026-33053 Summarize < 0.15.1 Insecure File Permissions Information Disclosure CVSS 4.0MEDIUM 6.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences