~ / search / GHSA-5624-2pmv-jx46

GHSA-5624-2pmv-jx46

Summarize contains a missing authorization vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-45243

Packages

EcosystemPackageAffectedFixed in
npm @steipete/summarize < 0.15.0 0.15.0

Details

As written in the advisory (Markdown source, shown as plain text).

Summarize prior to 0.15.0 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.

References

External links from the advisory. They lead to third-party sites.