CVE-2026-45245

Katalog CVE

CVSS 7.4 · High EPSS 0,45%

Kerentanan Server-Side Request Forgery (SSRF) pada steipete summarize. Skor CVSS 3.1 7.4 (High) menurut vulncheck.com.

Deskripsi (NVD)

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.

Rincian

Terbit di NVD

18 Mei 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.4 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)
CWE-940: Improper Verification of Source of a Communication Channel

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/steipete/summarize/commit/ecbb2c414255aa480a15d0d8b205224c14cfdbcb patch
• https://github.com/steipete/summarize/pull/218 exploit · issue tracking · patch
• https://www.vulncheck.com/advisories/summarize-unauthorized-daemon-request-via-untrusted-events advisory pihak ketiga
• https://github.com/steipete/summarize/releases/tag/v0.15.2 release notes