CVE-2026-45243
CVE-2026-45243 · Summarize < 0.15.1 Browser Extension Missing Authorization via Content Script
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.
CVSS 5.3 · Moyenne · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
summarize
- Versions du logiciel
- ≥ 0, < 0.15.1: Concernée (semver)
- 357544063af535bd574752622f9eb94be33ee5fd: Non concernée (git)
Mettez à jour vers 0.15.1
@steipete/summarize npm
- Plages de versions concernées
- SEMVER: < 0.15.0
Mettez à jour vers 0.15.0
Sources originales
- https://github.com/steipete/summarize/releases/tag/v0.15.2
- https://github.com/steipete/summarize/pull/222
- https://github.com/steipete/summarize/commit/357544063af535bd574752622f9eb94be33ee5fd
- https://www.vulncheck.com/advisories/summarize-browser-extension-missing-authorization-via-content-script
- https://nvd.nist.gov/vuln/detail/CVE-2026-45243