Log in Start free

Vulnerability · Published May 18, 2026 · Assigned by VulnCheck

CVE-2026-45244Summarize < 0.15.1 Unapproved Browser Automation Execution

Medium 5.4

In plain English

A medium-severity missing authorization in summarize from steipete. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 86.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@steipete/summarize0.15.0GHSA-67gq-6q8c-qqh6

Affected products (as reported)

VendorProductVersions
steipete summarize 0 – before 0.15.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References