PT-2026-41724 · Npm+1 · @Steipete/Summarize+1

Published 2026-05-18 · Updated 2026-05-20 · CVE-2026-45245

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Summarize versions prior to 0.15.1

Description The hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links. This causes the extension to make authenticated daemon requests using stored tokens without verifying if the event is trustworthy. Attackers can use local or private-network URLs behind hoverable links to route authenticated requests through the daemon, which may lead to unauthorized access to sensitive internal endpoints when users interact with malicious content.

Recommendations Update to version 0.15.1 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-940

CWE-918

Related Identifiers

CVE-2026-45245

GHSA-2R69-QGV3-HR65

Affected Products

@Steipete/Summarize

Summarize

References · 12

• 🔥 https://github.com/steipete/summarize/pull/218 · Exploit
• https://github.com/steipete/summarize/commit/ecbb2c414255aa480a15d0d8b205224c14cfdbcb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45245 · Security Note
• https://osv.dev/vulnerability/GHSA-2r69-qgv3-hr65 · Vendor Advisory
• https://github.com/steipete/summarize · Note
• https://github.com/steipete/summarize/releases/tag/v0.15.2 · Note
• https://github.com/steipete/summarize/releases/tag/v0.15.1 · Note
• https://t.me/cveNotify/163925 · Telegram Post
• https://twitter.com/CVEnew/status/2056994234264326166 · Twitter Post
• https://twitter.com/infoflowcloud/status/2056994931076452571 · Twitter Post
• https://vulncheck.com/advisories/summarize-unauthorized-daemon-request-via-untrusted-events · Note
• https://t.me/CVEtracker/54165 · Telegram Post