Summarize contains a path traversal vulnerability

高 7.1CVE-2026-45242 · GHSA-8jr4-6r33-phwm · 18/05/2026 公開 · 14/10/2026 更新

要点

CVE-2026-45242 は summarize (steipete), @steipete/summarize に影響する深刻度「高」 (CVSS 7.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.40%（全脆弱性の 34.0% より高い）。
対処：0.15.1, 0.15.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
summarize steipete	`< 0.15.1`	`0.15.1`
@steipete/summarize npm	`< 0.15.0`	`0.15.0`

概要

Summarize prior to 0.15.0 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction.

NVD の説明

Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit this to write slide_*.png and slides.json files to any writable directory and subsequently delete matching files at the specified location through repeat extraction.