{"id":"EUVD-2026-29196","enisaUuid":"e81b8dfc-0e84-367b-9b5c-b2163d4e7999","description":"Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json. A local attacker can exploit these permissive permissions to read the daemon bearer token and persisted provider credentials, enabling unauthorized access to the daemon or recovery of sensitive API keys.","datePublished":"May 11, 2026, 6:00:26 PM","dateUpdated":"Oct 8, 2026, 3:22:44 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/steipete/summarize/pull/214\nhttps://github.com/steipete/summarize/commit/0cfb0fb99777a87a7b02082b5e4bd449f8dd6175\nhttps://www.vulncheck.com/advisories/summarize-insecure-daemon-configuration-file-permissions\n","aliases":"CVE-2026-45222\n","assigner":"VulnCheck","epss":0.15,"enisaIdProduct":[{"id":"2e611dc9-b252-3c6d-8385-d8f625830c31","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"0 ≤0.14.1"},{"id":"3b9eb6a2-823e-3499-ae65-a7c6dbffb35b","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"patch: 0cfb0fb99777a87a7b02082b5e4bd449f8dd6175"}],"enisaIdVendor":[{"id":"f34f58e4-6941-3b90-bebf-414edad279cc","vendor":{"name":"steipete"}}],"enisaIdVulnerability":[{"id":"707e0e89-e5ce-3df2-bb6e-93dcf88d14d1","vulnerability":{"id":"GHSA-qp7v-gjgg-4mj6","description":"@steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json","datePublished":"May 11, 2026, 9:31:34 PM","dateUpdated":"May 18, 2026, 4:47:45 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-45222\nhttps://github.com/steipete/summarize/pull/214\nhttps://github.com/steipete/summarize/commit/0cfb0fb99777a87a7b02082b5e4bd449f8dd6175\nhttps://github.com/steipete/summarize\nhttps://github.com/steipete/summarize/releases/tag/v0.15.0\nhttps://www.vulncheck.com/advisories/summarize-insecure-daemon-configuration-file-permissions\n","enisa_id":"EUVD-2026-29196\n","aliases":"GHSA-qp7v-gjgg-4mj6\nCVE-2026-45222\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7ad09568-285b-3474-a18d-8b4772ceffcd","vulnerability":{"id":"CVE-2026-45222","description":"Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json. A local attacker can exploit these permissive permissions to read the daemon bearer token and persisted provider credentials, enabling unauthorized access to the daemon or recovery of sensitive API keys.","datePublished":"May 11, 2026, 6:00:26 PM","dateUpdated":"Oct 8, 2026, 3:22:44 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/steipete/summarize/pull/214\nhttps://github.com/steipete/summarize/commit/0cfb0fb99777a87a7b02082b5e4bd449f8dd6175\nhttps://www.vulncheck.com/advisories/summarize-insecure-daemon-configuration-file-permissions\n","enisa_id":"EUVD-2026-29196\n","assigner":"VulnCheck","epss":0.15,"dataProcessed":"Oct 30, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"18e4a3ef-81eb-3f95-9885-6587fa6e47dc","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"0 ≤0.14.1"},{"id":"fe39089d-ae6c-30c9-a051-dbcd98670203","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"patch: 0cfb0fb99777a87a7b02082b5e4bd449f8dd6175"}],"vulnerabilityVendor":[{"id":"43a21c08-6a65-35ec-ae07-6576efc82c03","vendor":{"name":"steipete"}}]}}],"enisaIdAdvisory":[]}