Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unautho…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 18, 2026 · NIST NVD

   Detected

   Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorizatio

2. Oct 14, 2026 · NIST NVD

   Updated

   Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorizatio

Affected

• cpe steipete/summarizeversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-45243

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-45243

  30-day exploitation probability 0.3%

  first.org
• NIST NVDVulnerability recordCVE-2026-45243

  Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers

  nvd.nist.gov

References

• Patch · github.com
• Exploit · github.com
• Release Notes · github.com
• Third Party Advisory · vulncheck.com