Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems.
References
| Link | Resource |
|---|---|
| https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098b | Patch |
| https://github.com/steipete/summarize/pull/217 | Exploit Issue Tracking Patch |
| https://github.com/steipete/summarize/releases/tag/v0.15.2 | Release Notes |
| https://www.vulncheck.com/advisories/summarize-insecure-file-permissions-information-disclosure | Third Party Advisory |
Configurations
History
19 May 2026, 01:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098b - Patch | |
| References | () https://github.com/steipete/summarize/pull/217 - Exploit, Issue Tracking, Patch | |
| References | () https://github.com/steipete/summarize/releases/tag/v0.15.2 - Release Notes | |
| References | () https://www.vulncheck.com/advisories/summarize-insecure-file-permissions-information-disclosure - Third Party Advisory | |
| CPE | cpe:2.3:a:steipete:summarize:*:*:*:*:*:*:*:* | |
| First Time |
Steipete summarize
Steipete |
18 May 2026, 20:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-18 20:16
Updated : 2026-05-19 01:34
NVD link : CVE-2026-45246
Mitre link : CVE-2026-45246
CVE.ORG link : CVE-2026-45246
JSON object : View
Products Affected
steipete
- summarize
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource