CVE-2026-45222

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45222

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45222.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45222

Aliases

GHSA-qp7v-gjgg-4mj6

Published

2026-05-11T18:00:26.205Z

Modified

2026-07-15T01:48:58.449075044Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Summarize Insecure Daemon Configuration File Permissions

Details

Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json. A local attacker can exploit these permissive permissions to read the daemon bearer token and persisted provider credentials, enabling unauthorized access to the daemon or recovery of sensitive API keys.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-732"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45222.json"
}

References

Affected packages

Git / github.com/steipete/summarize

Affected ranges

Type

GIT

Repo

https://github.com/steipete/summarize

Events

Introduced

Fixed

0b91c4f005fea1fd2a0e9b1d52bf66fed8f63060

Fixed

0cfb0fb99777a87a7b02082b5e4bd449f8dd6175

Database specific

{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.14.1"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.10.0

v0.11.1

v0.12.0

v0.13.0

v0.13.1

v0.14.0

v0.14.1

v0.2.0

v0.3.0

v0.4.0

v0.5.0

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.8.2

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45222.json"