CVE-2026-45242 Summarize < 0.15.1 Path Traversal via slidesDir Parameter

What is CVE-2026-45242?

CVE-2026-45242 is a high-severity path traversal vulnerability in steipete summarize, published on 18 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction.

Weakness: CWE-862

Which versions are affected by CVE-2026-45242?

2 open source packages ship an affected version, including @steipete/summarize. It affects 1 product.

Products include Steipete Summarize.

How do I fix CVE-2026-45242?

Upgrade @steipete/summarize to 0.15.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-45242 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45242 exists.

Other vulnerabilities in steipete summarize

• CVE-2026-45246 Summarize < 0.15.1 Insecure File Permissions Information Disclosure Medium 6.8
• CVE-2026-45243 Summarize < 0.15.1 Browser Extension Missing Authorization via Content Script Medium 5.3
• CVE-2026-45245 Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events Medium 4.6
• CVE-2026-45244 Summarize < 0.15.1 Unapproved Browser Automation Execution Low 2.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8jr4-6r33-phwm.