https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T17:10:11.377404+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-45222 CVE-2026-45222 — Summarize Insecure Daemon Configuration File Permissions 2026-09-30T17:10:11.380848+00:00

Affected: steipete summarize

Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json. A local attacker can exploit these permissive permissions to read the daemon bearer token and persisted provider credentials, enabling unauthorized access to the daemon or recovery of sensitive API keys.

 https://vulnerability.circl.lu/vuln/ghsa-qp7v-gjgg-4mj6 GHSA-qp7v-gjgg-4mj6 — @steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json 2026-09-30T17:10:11.380994+00:00

Affected: npm: @steipete/summarize

Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json. A local attacker can exploit these permissive permissions to read the daemon bearer token and persisted provider credentials, enabling unauthorized access to the daemon or recovery of sensitive API keys.