Summarize < 0.15.1 — CraftedSignal Threat Feed

Summarize Extension Mouseover Authenticated Request Vulnerability (CVE-2026-45245)

hello@craftedsignal.io — Mon, 18 May 2026 20:18:00 +0000

Summarize, a browser extension, is vulnerable to an authenticated request forgery via synthetic mouseover events. Prior to version 0.15.1, the extension’s hover summary feature fails to validate the trustworthiness of mouseover events. This allows a malicious webpage to dispatch synthetic events over attacker-controlled links. Consequently, the extension makes authenticated daemon requests using stored tokens, potentially routing these requests to local or private-network URLs. This vulnerability, identified as CVE-2026-45245, could enable attackers to access sensitive internal endpoints when users interact with malicious content through the extension.

Attack Chain

Attacker crafts a malicious webpage containing attacker-controlled links.
The malicious webpage uses JavaScript to dispatch synthetic mouseover events targeting the attacker-controlled links.
The Summarize extension’s hover summary feature processes the synthetic mouseover event without proper validation.
The extension generates an authenticated request to the daemon, based on the link targeted by the mouseover event.
The attacker-controlled link points to a local or private network URL.
The extension routes the authenticated request to the specified local or private network URL.
If the local or private network URL corresponds to an internal endpoint without proper authorization checks, the attacker may gain unauthorized access.
Successful exploitation allows the attacker to read sensitive information from the internal endpoint.

Impact

Successful exploitation of CVE-2026-45245 can allow attackers to access sensitive internal endpoints through a user’s Summarize extension. By placing local or private-network URLs behind hoverable links, attackers can route authenticated requests through the daemon, bypassing network security measures. The impact includes unauthorized access to internal resources and potential data exfiltration.

Recommendation

Upgrade the Summarize extension to version 0.15.1 or later to remediate CVE-2026-45245.
Deploy the Sigma rule “Detect Summarize Extension Synthetic Mouseover Event” to identify potential exploitation attempts.
Educate users about the risks of interacting with untrusted webpages and the potential for malicious mouseover events.

Summarize Path Traversal Vulnerability (CVE-2026-45242)

hello@craftedsignal.io — Mon, 18 May 2026 19:18:09 +0000

Summarize versions prior to 0.15.1 are susceptible to a path traversal vulnerability in the /v1/summarize daemon endpoint. This flaw allows authenticated users to write arbitrary files to any directory on the system where the Summarize application has write permissions. The vulnerability is triggered by manipulating the slidesDir request parameter, enabling attackers to inject absolute paths or directory traversal sequences. This can be exploited to write slide_*.png and slides.json files to locations outside of the intended directory and subsequently delete them, potentially leading to denial of service or other unexpected behavior. Defenders should ensure that Summarize is updated to version 0.15.1 or later to mitigate this risk.

Attack Chain

Attacker authenticates to the Summarize application.
Attacker crafts a malicious HTTP POST request to the /v1/summarize endpoint.
The request includes a slidesDir parameter containing a path traversal sequence (e.g., ../../) or an absolute path pointing to a sensitive directory.
The Summarize application processes the request without proper sanitization of the slidesDir parameter.
The application writes slide_*.png and slides.json files to the attacker-specified location.
The attacker sends a subsequent request to trigger the file deletion functionality, targeting the previously written files.
The Summarize application deletes the files at the specified location, leading to potential data loss or system instability.

Impact

Successful exploitation allows authenticated attackers to write and delete files in arbitrary directories accessible to the Summarize application. This can lead to data corruption, denial of service, or potentially arbitrary code execution if combined with other vulnerabilities or misconfigurations. The NVD rates this vulnerability with a CVSS v3.1 base score of 7.1, indicating a high severity.

Recommendation

Upgrade Summarize to version 0.15.1 or later to remediate CVE-2026-45242.
Deploy the Sigma rule “Detect Summarize Path Traversal Attempt via slidesDir” to identify potential exploitation attempts by monitoring HTTP requests to the /v1/summarize endpoint.
Implement input validation and sanitization on the slidesDir parameter to prevent path traversal attacks.