Summarize contains a missing authorization vulnerability

中 6.1CVE-2026-45243 · GHSA-5624-2pmv-jx46 · 18/05/2026 公開 · 14/10/2026 更新

要点

CVE-2026-45243 は summarize (steipete), @steipete/summarize に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.19%（全脆弱性の 9.3% より高い）。
対処：0.15.1, 0.15.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
summarize steipete	`< 0.15.1`	`0.15.1`
@steipete/summarize npm	`< 0.15.0`	`0.15.0`

概要

Summarize prior to 0.15.0 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.

NVD の説明

Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.