# CVE-2026-45222: steipete Summarize insecure file permissions in daemon configuration

Source: https://junglewise.ai/threats/cve-2026-45222-steipete-summarize-insecure-file-permissions-in-daemon  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-45222 · Severity: medium · CVSS 6.1 · Published 2026-05-11

Summarize is a tool that uses a background service (daemon) to process data. In versions up to 0.14.1, the software saves sensitive information—including security tokens and API keys—using insecure file settings on Unix-like systems (such as Linux or macOS). This allows other users on the same computer to read these secrets, potentially leading to unauthorized access to the service or the theft of linked API credentials.

Technologies: [@steipete/summarize (npm)](https://junglewise.ai/threats/technologies/steipete-summarize), [Steipete Summarize](https://junglewise.ai/threats/technologies/summarize). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Steipete](https://junglewise.ai/threats/vendors/steipete).

## Quick answers

**Is CVE-2026-45222 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45222 being exploited in the wild.

**How severe is CVE-2026-45222?** Medium severity, with a CVSS score of 6.1, published 11 May 2026.

**Which products and versions are affected?** @steipete/summarize (npm) < 0.15.0, SEMVER:introduced=0,fixed=0.15.0; Steipete Summarize < 0.15.0, <= 0.14.1.

**Is there a fix for CVE-2026-45222?** Yes. @steipete/summarize (npm): upgrade to 0.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45222 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-45222?** Check whether you run @steipete/summarize (npm) or Steipete Summarize at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @steipete/summarize (npm): upgrade to 0.15.0 or later

  ```sh
  npm install @steipete/summarize@0.15.0
  ```


## Technical details

A vulnerability exists in the daemon configuration storage of Summarize (up to version 0.14.1) due to incorrect permission assignment (CWE-732). The application creates the '~/.summarize' directory and 'daemon.json' file using default filesystem umask settings rather than explicit private modes (e.g., 0700/0600). On many Unix-like systems, this results in world-readable or group-readable files. A local attacker with access to the same system can read the configuration file to extract bearer tokens and persisted provider API keys. The issue was addressed in commit 0cfb0fb by enforcing private file modes and implementing a best-effort repair of existing loose permissions during configuration rewrites.

## Affected products

- steipete summarize <= 0.14.1

## Identifiers

- CVE-2026-45222
- GHSA-qp7v-gjgg-4mj6

## Timeline

- 2026-05-07: disclosed: Initial pull request submitted by researcher
- 2026-05-08: patched: Fix merged into main branch
- 2026-05-11: advisory: CVE-2026-45222 published

## References

- [https://github.com/steipete/summarize/commit/0cfb0fb99777a87a7b02082b5e4bd449f8dd6175](https://github.com/steipete/summarize/commit/0cfb0fb99777a87a7b02082b5e4bd449f8dd6175)
- [https://github.com/steipete/summarize/pull/214](https://github.com/steipete/summarize/pull/214)
- [https://www.vulncheck.com/advisories/summarize-insecure-daemon-configuration-file-permissions](https://www.vulncheck.com/advisories/summarize-insecure-daemon-configuration-file-permissions)

## Related threats

- [steipete Summarize SSRF in podcast RSS transcript fetching](https://junglewise.ai/threats/cve-2026-53782-steipete-summarize-ssrf-in-podcast-rss-transcript-fetching)
- [steipete summarize disk exhaustion via uncapped media download](https://junglewise.ai/threats/cve-2026-53781-steipete-summarize-disk-exhaustion-via-uncapped-media-download)
- [steipete Summarize insecure file permissions in refresh-free path](https://junglewise.ai/threats/cve-2026-45246-steipete-summarize-insecure-file-permissions-in-refresh-free-path)
- [steipete Summarize SSRF via synthetic mouseover events](https://junglewise.ai/threats/cve-2026-45245-steipete-summarize-ssrf-via-synthetic-mouseover-events)
- [steipete Summarize missing authorization in browser automation](https://junglewise.ai/threats/cve-2026-45244-steipete-summarize-missing-authorization-in-browser-automation)