CVE-2026-45244 Summarize < 0.15.1 Unapproved Browser Automation Execution

What is CVE-2026-45244?

CVE-2026-45244 is a low-severity missing authorization vulnerability in steipete summarize, published on 18 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.

Weakness: CWE-862

Which versions are affected by CVE-2026-45244?

2 open source packages ship an affected version, including @steipete/summarize. It affects 1 product.

Products include Steipete Summarize.

How do I fix CVE-2026-45244?

Upgrade @steipete/summarize to 0.15.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-45244 being exploited?

There is no known exploitation of CVE-2026-45244 in the wild and no public exploit code.

Other vulnerabilities in steipete summarize

• CVE-2026-45242 Summarize < 0.15.1 Path Traversal via slidesDir Parameter High 7.1
• CVE-2026-45246 Summarize < 0.15.1 Insecure File Permissions Information Disclosure Medium 6.8
• CVE-2026-45243 Summarize < 0.15.1 Browser Extension Missing Authorization via Content Script Medium 5.3
• CVE-2026-45245 Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events Medium 4.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-67gq-6q8c-qqh6.