Answer in brief
CVE-2026-45246 records a Medium severity (CVSS 6.8) vulnerability in Summarize < 0.15.1 Insecure File Permissions Information Disclosure. The current sources do not mark it as known exploited. The current feed maps steipete/summarize (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps steipete/summarize (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:steipete:summarize:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| steipete/summarizegeneric | >=0 <0.15.1 | 0.15.1 |
Published upstream
May 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 22, 2026
Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems.
Quoted source text, attributed separately from HOL analysis.