PT-2026-41723 · Npm+1 · @Steipete/Summarize+1

Published 2026-05-18 · Updated 2026-05-20 · CVE-2026-45244

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Summarize versions prior to 0.15.1

Description A missing authorization issue allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. By using malicious page or summary content, attackers can influence the agent to invoke enabled extension automation tools, such as navigation or debugger-backed actions, bypassing the final user approval step during interaction with attacker-controlled content.

Recommendations Update to version 0.15.1 or later. As a temporary workaround, disable the extension automation feature to prevent unauthorized browser automation actions.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-45244

GHSA-67GQ-6Q8C-QQH6

Affected Products

@Steipete/Summarize

Summarize

References · 11

• https://github.com/steipete/summarize/pull/219 · Patch
• https://github.com/steipete/summarize/commit/e64fe3ecd1bb4fdc181dcfa88c96b9e1914ced0e · Patch
• https://osv.dev/vulnerability/GHSA-67gq-6q8c-qqh6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45244 · Security Note
• https://github.com/steipete/summarize · Note
• https://github.com/steipete/summarize/releases/tag/v0.15.2 · Note
• https://github.com/steipete/summarize/releases/tag/v0.15.1 · Note
• https://t.me/CVEtracker/54164 · Telegram Post
• https://twitter.com/CVEnew/status/2056994235371688366 · Twitter Post
• https://twitter.com/infoflowcloud/status/2056994944934391937 · Twitter Post
• https://vulncheck.com/advisories/summarize-unapproved-browser-automation-execution · Note