CVE-2026-45245 Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted Events
Malicious web pages can trigger authenticated daemon requests to internal endpoints via synthetic hover events, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-45245?
CVE-2026-45245 is a medium-severity server-side request forgery vulnerability in steipete summarize, published on 18 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.
Which versions are affected by CVE-2026-45245?
2 open source packages ship an affected version, including @steipete/summarize. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@steipete/summarize npm | All versions | 0.15.1 |
@steipete/summarize npm | All versions | 0.15.1 |
Products include Steipete Summarize.
How do I fix CVE-2026-45245?
Upgrade @steipete/summarize to 0.15.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-45245 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45245 exists.
Other vulnerabilities in steipete summarize
- CVE-2026-45242 Summarize < 0.15.1 Path Traversal via slidesDir Parameter
- CVE-2026-45246 Summarize < 0.15.1 Insecure File Permissions Information Disclosure
- CVE-2026-45243 Summarize < 0.15.1 Browser Extension Missing Authorization via Content Script
- CVE-2026-45244 Summarize < 0.15.1 Unapproved Browser Automation Execution
Sources
Also known as GHSA-2r69-qgv3-hr65.