CVE-2026-45243

Katalog CVE

CVSS 6.1 · Medium EPSS 0,33%

Kerentanan Missing Authorization pada steipete summarize. Skor CVSS 3.1 6.1 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.

Rincian

Terbit di NVD

18 Mei 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/steipete/summarize/commit/357544063af535bd574752622f9eb94be33ee5fd patch
• https://github.com/steipete/summarize/pull/222 exploit · issue tracking · patch
• https://www.vulncheck.com/advisories/summarize-browser-extension-missing-authorization-via-content-script advisory pihak ketiga
• https://github.com/steipete/summarize/releases/tag/v0.15.2 release notes