Is CVE-2026-45222 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45222 being exploited in the wild.

How severe is CVE-2026-45222?

Medium severity, with a CVSS score of 6.1, published 11 May 2026.

Which products and versions are affected?

@steipete/summarize (npm) < 0.15.0, SEMVER:introduced=0,fixed=0.15.0; Steipete Summarize < 0.15.0, <= 0.14.1.

Is there a fix for CVE-2026-45222?

Yes. @steipete/summarize (npm): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45222 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-45222?

Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45222: steipete Summarize insecure file permissions in daemon configuration

Q: Is there a fix for CVE-2026-45222?

Yes. @steipete/summarize (npm): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45222 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2026-45222?

Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45222 · Severity: medium · CVSS 6.1 · Published 2026-05-11

Summarize is a tool that uses a background service (daemon) to process data. In versions up to 0.14.1, the software saves sensitive information—including security tokens and API keys—using insecure file settings on Unix-like systems (such as Linux or macOS). This allows other users on the same computer to read these secrets, potentially leading to unauthorized access to the service or the theft of linked API credentials.

Technologies: @steipete/summarize (npm), Steipete Summarize. Vendors: npm, Steipete.

Quick answers

Is CVE-2026-45222 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45222 being exploited in the wild.
How severe is CVE-2026-45222?: Medium severity, with a CVSS score of 6.1, published 11 May 2026.
Which products and versions are affected?: @steipete/summarize (npm) < 0.15.0, SEMVER:introduced=0,fixed=0.15.0; Steipete Summarize < 0.15.0, <= 0.14.1.
Is there a fix for CVE-2026-45222?: Yes. @steipete/summarize (npm): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45222 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-45222?: Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@steipete/summarize (npm): upgrade to 0.15.0 or later
```
npm install @steipete/summarize@0.15.0
```

Technical details

A vulnerability exists in the daemon configuration storage of Summarize (up to version 0.14.1) due to incorrect permission assignment (CWE-732). The application creates the '~/.summarize' directory and 'daemon.json' file using default filesystem umask settings rather than explicit private modes (e.g., 0700/0600). On many Unix-like systems, this results in world-readable or group-readable files. A local attacker with access to the same system can read the configuration file to extract bearer tokens and persisted provider API keys. The issue was addressed in commit 0cfb0fb by enforcing private file modes and implementing a best-effort repair of existing loose permissions during configuration rewrites.

Affected products

steipete summarize <= 0.14.1

Identifiers

CVE-2026-45222
GHSA-qp7v-gjgg-4mj6

Timeline

2026-05-07: disclosed: Initial pull request submitted by researcher
2026-05-08: patched: Fix merged into main branch
2026-05-11: advisory: CVE-2026-45222 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.