{"id":"EUVD-2026-30795","enisaUuid":"0f0efc76-730e-3dd8-817c-a3ef38c6c1f2","description":"Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.","datePublished":"May 18, 2026, 7:00:54 PM","dateUpdated":"Oct 8, 2026, 3:22:48 PM","baseScore":4.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/steipete/summarize/releases/tag/v0.15.2\nhttps://github.com/steipete/summarize/pull/218\nhttps://github.com/steipete/summarize/commit/ecbb2c414255aa480a15d0d8b205224c14cfdbcb\nhttps://www.vulncheck.com/advisories/summarize-unauthorized-daemon-request-via-untrusted-events\n","aliases":"CVE-2026-45245\nGHSA-2r69-qgv3-hr65\n","assigner":"VulnCheck","epss":0.33,"enisaIdProduct":[{"id":"78568547-e4e0-36d1-b0f1-86625851f99f","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"0 \u003c0.15.1"},{"id":"dbdad7c3-ff43-3fde-a2ae-9f0d14a44a97","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"patch: ecbb2c414255aa480a15d0d8b205224c14cfdbcb"}],"enisaIdVendor":[{"id":"e591ce98-85a4-358e-9008-c0917c6b7c3d","vendor":{"name":"steipete"}}],"enisaIdVulnerability":[{"id":"78343d97-64de-3099-bccd-f402b39b3339","vulnerability":{"id":"CVE-2026-45245","description":"Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. Attackers can place local or private-network URLs behind hoverable links to route authenticated requests through the daemon, potentially accessing sensitive internal endpoints when users interact with attacker-controlled content.","datePublished":"May 18, 2026, 7:00:54 PM","dateUpdated":"Oct 8, 2026, 3:22:48 PM","status":"PUBLISHED","baseScore":4.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","references":"https://github.com/steipete/summarize/releases/tag/v0.15.2\nhttps://github.com/steipete/summarize/pull/218\nhttps://github.com/steipete/summarize/commit/ecbb2c414255aa480a15d0d8b205224c14cfdbcb\nhttps://www.vulncheck.com/advisories/summarize-unauthorized-daemon-request-via-untrusted-events\n","enisa_id":"EUVD-2026-30795\n","assigner":"VulnCheck","epss":0.33,"dataProcessed":"Nov 3, 2026, 7:17:32 AM","vulnerabilityProduct":[{"id":"7fef0409-6eb9-35c6-a32a-41a331463f92","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"patch: ecbb2c414255aa480a15d0d8b205224c14cfdbcb"},{"id":"912a6bb3-6dc8-3a20-ad5e-540cf65308c8","product":{"name":"summarize","vendor":{"name":"steipete"}},"product_version":"0 \u003c0.15.1"}],"vulnerabilityVendor":[{"id":"8392b103-20c7-319d-84c1-38a7bb8762a6","vendor":{"name":"steipete"}}]}},{"id":"e5fee0b4-b041-3203-a548-7987df96791c","vulnerability":{"id":"GHSA-2r69-qgv3-hr65","description":"Summarize\u0027s hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links","datePublished":"May 18, 2026, 9:31:51 PM","dateUpdated":"May 29, 2026, 8:00:00 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-45245\nhttps://github.com/steipete/summarize/pull/218\nhttps://github.com/steipete/summarize/commit/ecbb2c414255aa480a15d0d8b205224c14cfdbcb\nhttps://github.com/steipete/summarize\nhttps://github.com/steipete/summarize/releases/tag/v0.15.1\nhttps://github.com/steipete/summarize/releases/tag/v0.15.2\nhttps://www.vulncheck.com/advisories/summarize-unauthorized-daemon-request-via-untrusted-events\n","enisa_id":"EUVD-2026-30795\n","aliases":"GHSA-2r69-qgv3-hr65\nCVE-2026-45245\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}