steipete summarize up to 0.14.1 ~/.summarize/daemon.json permission assignment

Summaryinfo

A vulnerability was found in steipete summarize up to 0.14.1. It has been classified as problematic. Affected by this issue is some unknown functionality of the file ~/.summarize/daemon.json. The manipulation leads to permission assignment. This vulnerability is traded as CVE-2026-45222. An attack has to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in steipete summarize up to 0.14.1 and classified as problematic. This issue affects an unknown code block of the file ~/.summarize/daemon.json. The manipulation with an unknown input leads to a permission assignment vulnerability. Using CWE to declare the problem leads to CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json. A local attacker can exploit these permissive permissions to read the daemon bearer token and persisted provider credentials, enabling unauthorized access to the daemon or recovery of sensitive API keys.

The weakness was shared by Chia Min Jun Lennon. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-45222 since 05/11/2026. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:~/.summarize/daemon.json it is possible to find vulnerable targets with Google Hacking.

Applying the patch 0cfb0fb99777a87a7b02082b5e4bd449f8dd6175 is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• steipete

Name

• summarize

Version

• 0.14.0
• 0.14.1

Website

• Product: https://github.com/steipete/summarize/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion