CVE-2026-45246

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45246

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45246.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45246

Published

2026-05-18T19:03:34.753Z

Modified

2026-07-08T08:13:30.189763269Z

Severity

6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Summarize < 0.15.1 Insecure File Permissions Information Disclosure

Details

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45246.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-732"
    ]
}

References

Affected packages

Git / github.com/steipete/summarize

Affected ranges

Type

GIT

Repo

https://github.com/steipete/summarize

Events

Introduced

Fixed

8db0d04f38ba0cfeec805547f7ad58052bd3cf5f

Fixed

9e990193650a23dab73f37d5e1964d574a44098b

Fixed

e34ce25c05e3c21aca7876695d6d64c00cca7a6e

Database specific

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:steipete:summarize:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.15.1"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.2

v0.10.0

v0.11.1

v0.12.0

v0.13.0

v0.13.1

v0.14.0

v0.14.1

v0.15.0

v0.15.1

v0.2.0

v0.3.0

v0.4.0

v0.5.0

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.8.2

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45246.json"