PT-2026-39728 · Summarize · Summarize

Hinotoi-Agent · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-45222

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Summarize versions prior to 0.14.1

Description The software creates the daemon configuration directory and file using default filesystem permissions that may be world-readable on Unix-like systems. This allows local attackers to read the ~/.summarize/daemon.json file, which contains bearer tokens and persisted provider API credentials. By exploiting these permissive permissions, an attacker can gain unauthorized access to the daemon or recover sensitive API keys.

Recommendations Update to the version containing commit 0cfb0fb.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2026-45222

GHSA-QP7V-GJGG-4MJ6

Affected Products

Summarize

References · 10

• 🔥 https://github.com/steipete/summarize/pull/214 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45222.json · Exploit
• https://github.com/steipete/summarize/commit/0cfb0fb99777a87a7b02082b5e4bd449f8dd6175 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45222 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45222 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qp7v-gjgg-4mj6 · Vendor Advisory
• https://github.com/steipete/summarize · Note
• https://github.com/steipete/summarize/releases/tag/v0.15.0 · Note
• https://twitter.com/CVEnew/status/2053932391346139225 · Twitter Post
• https://vulncheck.com/advisories/summarize-insecure-daemon-configuration-file-permissions · Note